What’s new?

Welcome to the Sectigo Certificate Manager (SCM) Enterprise release notes. This page highlights the most recent updates across SCM Enterprise and its connected integrations, covering the latest improvements, API updates, and resolved issues.

Private key agent v2.4

^{October 27, 2026}

This release includes the following updates and resolved issues:

General updates

Change Reference number

Change	Reference number
Sectigo Private Key Agent rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. Private Key Agent fails these chains with `x509: no valid chains built`. This applies to its outbound TLS connections to Sectigo Certificate Manager, HashiCorp Vault, and Azure Key Vault. Connections that use other CAs are not affected. If one of these endpoints uses one of these chains, install a certificate from a different CA.	SCM-15831
The Sectigo Private Key Agent’s HTTPS endpoint now accepts only TLS 1.2 and later. Earlier builds were compiled with a Go runtime that still accepted TLS 1.0 and 1.1 by default, so security scans could flag the endpoint for allowing these protocols. Private Key Agent 2.4 updates the runtime, and connection attempts using TLS 1.0 or 1.1 are now refused. Clients that connect to the endpoint must support TLS 1.2 or later.	SCM-15233
Updated graphics to match the new company brand.	SCM-14998

Sectigo Private Key Agent rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. Private Key Agent fails these chains with x509: no valid chains built. This applies to its outbound TLS connections to Sectigo Certificate Manager, HashiCorp Vault, and Azure Key Vault. Connections that use other CAs are not affected. If one of these endpoints uses one of these chains, install a certificate from a different CA.

SCM-15831

The Sectigo Private Key Agent’s HTTPS endpoint now accepts only TLS 1.2 and later. Earlier builds were compiled with a Go runtime that still accepted TLS 1.0 and 1.1 by default, so security scans could flag the endpoint for allowing these protocols. Private Key Agent 2.4 updates the runtime, and connection attempts using TLS 1.0 or 1.1 are now refused. Clients that connect to the endpoint must support TLS 1.2 or later.

SCM-15233

Updated graphics to match the new company brand.

SCM-14998

Resolved issues

Change	Reference number
Enrollment would fail with the ECC Cert Key types when using Azure.	SCM-11874

Change

Reference number

Enrollment would fail with the ECC Cert Key types when using Azure.

SCM-11874

For earlier releases, see Private key agent release notes.

Orchestration gateway v2.1.1

Released: October 27, 2026
Build: 2.1.1-553

This release includes the following updates and resolved issues:

General updates

Change Reference number

Change	Reference number
Sectigo Orchestration Gateway rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. The orchestration gateway now fails these chains with `x509: no valid chains built`. This applies to outbound TLS connections where certificate verification is enabled, such as Sectigo Certificate Manager, Vault, trusted F5, and Imperva endpoints, and proxies. Connections that use other CAs, or that skip verification, are not affected. If an endpoint that the orchestration gateway connects to uses one of these chains, install a certificate from a different CA.	SCM-15770

Sectigo Orchestration Gateway rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. The orchestration gateway now fails these chains with x509: no valid chains built. This applies to outbound TLS connections where certificate verification is enabled, such as Sectigo Certificate Manager, Vault, trusted F5, and Imperva endpoints, and proxies. Connections that use other CAs, or that skip verification, are not affected. If an endpoint that the orchestration gateway connects to uses one of these chains, install a certificate from a different CA.

SCM-15770

Resolved issues

Change	Reference number
Fixed minor security vulnerabilites related to Golang and Go toolchain.	SCM-15770
Fixed issue that was causing VirusTotal and other security vendor’s to warn against the SOG 2.1 MSI installer.	SCM-15787

Change

Reference number

Fixed minor security vulnerabilites related to Golang and Go toolchain.

SCM-15770

Fixed issue that was causing VirusTotal and other security vendor’s to warn against the SOG 2.1 MSI installer.

SCM-15787

For earlier releases, see Orchestration gateway release notes.

CA connector v3.6

^{October 24, 2026}

This release includes the following updates and improvements:

General updates

Change Reference number

Change	Reference number
Sectigo CA Connector rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. CA Connector fails these chains with `x509: no valid chains built`. This applies to outbound TLS connections where certificate verification is enabled, such as Sectigo Certificate Manager, the CA backends it manages (DigiCert, EJBCA, GlobalSign Atlas, Google Cloud CA Service), and proxies. Connections that use other CAs, or that skip verification, are not affected. If an endpoint CA Connector connects to uses one of these chains, install a certificate from a different CA.	SCM-15832
CA Connector now supports GlobalSign.	SCM-13814
CA Connector now supports EJBCA.	SCM-14520
Support for Entrust has been deprecated.	SCM-14886
The Manage CA permission for Microsoft CA is no longer required.	SCM-15548

Sectigo CA Connector rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. CA Connector fails these chains with x509: no valid chains built. This applies to outbound TLS connections where certificate verification is enabled, such as Sectigo Certificate Manager, the CA backends it manages (DigiCert, EJBCA, GlobalSign Atlas, Google Cloud CA Service), and proxies. Connections that use other CAs, or that skip verification, are not affected. If an endpoint CA Connector connects to uses one of these chains, install a certificate from a different CA.

SCM-15832

CA Connector now supports GlobalSign.

SCM-13814

CA Connector now supports EJBCA.

SCM-14520

Support for Entrust has been deprecated.

SCM-14886

The Manage CA permission for Microsoft CA is no longer required.

SCM-15548

For earlier releases, see CA connector release notes.

SCM v26.10

^{October 24, 2026}

This release of SCM Enterprise includes the following updates and improvements:

General updates

Change	Reference number
Support for GlobalSign for issuing public SSL certificates.	SCM-13814
Support for EJBCA for issuing private SSL certificates.	SCM-14520
SCEP RA certificates now support automatic issuance from a client certificate profile, making enrollment faster and renewal automated.	SCM-13303
New date formats are available in General Settings.	SCM-10682
Support for configuring Sectigo Orchestration Gateway’s endpoints using the credential store option.	SCM-15120
Persistent Validation DCV validations will now automatically renew every 7 days.	SCM-15339
New option to filter domains by DCV method.	SCM-15363
Improved handling of MS Agent disconnected notifications if the agent fails to send heartbeats but is performing other actions. Only the first notification will be sent until a heartbeat is received.	SCM-15704

Change

Reference number

Support for GlobalSign for issuing public SSL certificates.

SCM-13814

Support for EJBCA for issuing private SSL certificates.

SCM-14520

SCEP RA certificates now support automatic issuance from a client certificate profile, making enrollment faster and renewal automated.

SCM-13303

New date formats are available in General Settings.

SCM-10682

Support for configuring Sectigo Orchestration Gateway’s endpoints using the credential store option.

SCM-15120

Persistent Validation DCV validations will now automatically renew every 7 days.

SCM-15339

New option to filter domains by DCV method.

SCM-15363

Improved handling of MS Agent disconnected notifications if the agent fails to send heartbeats but is performing other actions. Only the first notification will be sent until a heartbeat is received.

SCM-15704

REST API Enhancements

Change	Reference number
Improved filtering options on Admin REST API.	SCM-14184

Change

Reference number

Improved filtering options on Admin REST API.

SCM-14184

Resolved issues

Issue	Reference number
Moving a private key to another Network Agent instance might have failed if other key migrations were already in progress.	SCM-15561
Enrollment using EST endpoint might have failed if the account URI contained uppercase characters.	SCM-15523
Occasionally, when editing a certificate profile for an external CA such as MS CA, a warning about the template no longer being available would appear.	SCM-15435
Mark certificates orders might have remained in the applied status even after issuance by the CA.	SCM-15403
Assigning an SSL certificate to a department via API would have failed to validate the department that had delegated access to the certificate’s domains.	SCM-15171
If the requester for a code signing certificate had a name longer than 64 characters, the request was submitted to the CA but not recorded in SCM.	SCM-14069

Issue

Reference number

Moving a private key to another Network Agent instance might have failed if other key migrations were already in progress.

SCM-15561

Enrollment using EST endpoint might have failed if the account URI contained uppercase characters.

SCM-15523

Occasionally, when editing a certificate profile for an external CA such as MS CA, a warning about the template no longer being available would appear.

SCM-15435

Mark certificates orders might have remained in the applied status even after issuance by the CA.

SCM-15403

Assigning an SSL certificate to a department via API would have failed to validate the department that had delegated access to the certificate’s domains.

SCM-15171

If the requester for a code signing certificate had a name longer than 64 characters, the request was submitted to the CA but not recorded in SCM.

SCM-14069

For earlier releases, see SCM Enterprise release notes.

Network agent v5.6

This release includes the following general updates:

Change	Reference number
Improved handling of discovery of nodes when one agent is connected to large number of servers.	SCM-14157
Improved handling of CSR generation if network issues interrupted initial request.	SCM-13717
Improved rewriting Tomcat <Connector> to <SSLHostConfig> elements so that all deprecated attributes are dropped.	SCM-14794
Upload of certificates to remove Linux targets from Windows agent would result in error 110.	SCM-14153
When using the Docker-based Network Agent, logs to stdout would stop after the internal log file was rotated.	SCM-14488
Added support for: Windows Server 2025 Debian 13 Ubuntu 26.04 RedHat 10 Rocky 10	SCM-14312
Added support for F5 Big IP 17.5 and 21.	SCM-14313
Updated third-party components to address the following vulnerabilities: CVE-2025-21587 CVE-2025-53066 CVE-2026-22016 CVE-2026-34282	SCM-14662

Change

Reference number

Improved handling of discovery of nodes when one agent is connected to large number of servers.

SCM-14157

Improved handling of CSR generation if network issues interrupted initial request.

SCM-13717

Improved rewriting Tomcat <Connector> to <SSLHostConfig> elements so that all deprecated attributes are dropped.

SCM-14794

Upload of certificates to remove Linux targets from Windows agent would result in error 110.

SCM-14153

When using the Docker-based Network Agent, logs to stdout would stop after the internal log file was rotated.

SCM-14488

Added support for:

Windows Server 2025
Debian 13
Ubuntu 26.04
RedHat 10
Rocky 10

SCM-14312

Added support for F5 Big IP 17.5 and 21.

SCM-14313

Updated third-party components to address the following vulnerabilities:

CVE-2025-21587
CVE-2025-53066
CVE-2026-22016
CVE-2026-34282

SCM-14662

For earlier releases, see Network agent release notes.

DNS connector v2.0

This release includes the following updates and improvements:

General updates

Change Reference number

Change	Reference number
The DNS connector now supports LEGO DNS providers, including all providers available up to LEGO version 4.31. These providers are bundled with the DNS connector and can be used with the `lego` provider type.	SCM-13509

The DNS connector now supports LEGO DNS providers, including all providers available up to LEGO version 4.31. These providers are bundled with the DNS connector and can be used with the lego provider type.

SCM-13509

Resolved issues

Change	Reference number
Starting with DNS connector 1.3, created entries for Cloudflare, DNSimple, and OVH would not be deleted after validation was complete.	SCM-14297

Change

Reference number

Starting with DNS connector 1.3, created entries for Cloudflare, DNSimple, and OVH would not be deleted after validation was complete.

SCM-14297

For earlier releases, see DNS connector release notes.

MS agent v4.4

This release includes the following updates and improvements:

General updates

Change	Reference number
The performance of the Certification Authority snap‑in has been enhanced, resulting in much faster loading and navigation of issued certificates in high‑volume deployments.	SCM-13143
There is improved HTTP proxy compatibility by including the port number in the CONNECT request as well as the Host header.	SCM-12270
Startup no longer converts CA private keys to non‑exportable by default; this can be enabled via the PrivateKeyNonExportable registry setting.	SCM-13903

Change

Reference number

The performance of the Certification Authority snap‑in has been enhanced, resulting in much faster loading and navigation of issued certificates in high‑volume deployments.

SCM-13143

There is improved HTTP proxy compatibility by including the port number in the CONNECT request as well as the Host header.

SCM-12270

Startup no longer converts CA private keys to non‑exportable by default; this can be enabled via the PrivateKeyNonExportable registry setting.

SCM-13903

Resolved issues

Change	Reference number
Fixed a regression in MS Agent 4.3 that caused certificate requests to fail for Active Directory Certificate Templates requiring manual SAN entry.	SCM-12534
Improved handling of network loss during initialization, which previously resulted in logging the error "The specified domain either does not exist or could not be contacted."	SCM-12995
Fixed an issue where CA names containing spaces were parsed incorrectly, preventing the CA’s AD Configuration container from being located during discovery.	SCM-13187
Resolved an issue where conflicting error codes caused incorrect permission‑related error messages to appear during enrollment.	SCM-13380
Fixed an issue where startup without SCM connectivity caused the CA console to hide existing certificate templates and delete the assigned template list when attempting to add a new one.	SCM-13922

Change

Reference number

Fixed a regression in MS Agent 4.3 that caused certificate requests to fail for Active Directory Certificate Templates requiring manual SAN entry.

SCM-12534

Improved handling of network loss during initialization, which previously resulted in logging the error "The specified domain either does not exist or could not be contacted."

SCM-12995

Fixed an issue where CA names containing spaces were parsed incorrectly, preventing the CA’s AD Configuration container from being located during discovery.

SCM-13187

Resolved an issue where conflicting error codes caused incorrect permission‑related error messages to appear during enrollment.

SCM-13380

Fixed an issue where startup without SCM connectivity caused the CA console to hide existing certificate templates and delete the assigned template list when attempting to add a new one.

SCM-13922

For earlier releases, see MS agent release notes.

Network agent v5.5

This release includes the following general updates:

Change	Reference number
Improved script that collects IIS server information to operate on Windows desktop operating systems that don’t have required IIS features installed.	SCM-12839
Resolved issue of installation of wildcard certificates to Apache servers from a Network Agent installed on Windows that would fail with an error saying “The filename, directory name, or volume label syntax is incorrect”.	SCM-12874

Change

Reference number

Improved script that collects IIS server information to operate on Windows desktop operating systems that don’t have required IIS features installed.

SCM-12839

Resolved issue of installation of wildcard certificates to Apache servers from a Network Agent installed on Windows that would fail with an error saying “The filename, directory name, or volume label syntax is incorrect”.

SCM-12874

For earlier releases, see Network agent release notes.