Private key agent release notes

This page provides release notes for the Sectigo Certificate Manager (SCM) Enterprise private key agent.

The private key agent documentation can be found in the following location:

Private key agent v2.4

October 27, 2026

This release includes the following updates and resolved issues:

General updates

Change Reference number

Sectigo Private Key Agent rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. Private Key Agent fails these chains with x509: no valid chains built. This applies to its outbound TLS connections to Sectigo Certificate Manager, HashiCorp Vault, and Azure Key Vault. Connections that use other CAs are not affected. If one of these endpoints uses one of these chains, install a certificate from a different CA.

SCM-15831

The Sectigo Private Key Agent’s HTTPS endpoint now accepts only TLS 1.2 and later. Earlier builds were compiled with a Go runtime that still accepted TLS 1.0 and 1.1 by default, so security scans could flag the endpoint for allowing these protocols. Private Key Agent 2.4 updates the runtime, and connection attempts using TLS 1.0 or 1.1 are now refused. Clients that connect to the endpoint must support TLS 1.2 or later.

SCM-15233

Updated graphics to match the new company brand.

SCM-14998

Resolved issues

Change Reference number

Enrollment would fail with the ECC Cert Key types when using Azure.

SCM-11874

Private key agent v2.3

This release includes the following general updates:

Change Reference number

On some systems, the agent would fail when generating CSR and key.

SCM-9723

Improved performance when processing large numbers of key generation requests.

SCM-11056

Private key agent v2.2

This release includes the following general updates:

Change Reference number

The agent now maintains HashiCorp Vault authentication through connection issues.

SCM-9528

Downloaded Java Key Store (JKS) format files now includes the public certificate.

SCM-9518

Private key agent v2.1

This release includes the following general updates:

Change Reference number

Adds support for using AppRole when authenticating to HashiCorp Vault.

  • Configuration is done via the pkagent configuration utility.

  • Supports direct configuration of the role secret via the command line or inclusion of the role secret in a file.

SCM-9051

Adds support for changing download filenames.

  • Configuration is done via the pkagent configuration utility.

  • Supports cert_{ID}.ext (existing), {common name}.ext and {subject}.ext formats.

SCM-9050

Adds support for replacing the local SSL certificate.

  • Configuration is done via the pkagent configuration utility.

SCM-9070