What’s new?

Welcome to the Sectigo Certificate Manager (SCM) Enterprise release notes. This page highlights the most recent updates across SCM Enterprise and its connected integrations, covering the latest improvements, API updates, and resolved issues.

MS agent v4.4

This release includes the following updates and improvements:

General updates

Change Reference number

The performance of the Certification Authority snap‑in has been enhanced, resulting in much faster loading and navigation of issued certificates in high‑volume deployments.

SCM-13143

There is improved HTTP proxy compatibility by including the port number in the CONNECT request as well as the Host header.

SCM-12270

Startup no longer converts CA private keys to non‑exportable by default; this can be enabled via the PrivateKeyNonExportable registry setting.

SCM-13903

Resolved issues

Change Reference number

Fixed a regression in MS Agent 4.3 that caused certificate requests to fail for Active Directory Certificate Templates requiring manual SAN entry.

SCM-12534

Improved handling of network loss during initialization, which previously resulted in logging the error "The specified domain either does not exist or could not be contacted."

SCM-12995

Fixed an issue where CA names containing spaces were parsed incorrectly, preventing the CA’s AD Configuration container from being located during discovery.

SCM-13187

Resolved an issue where conflicting error codes caused incorrect permission‑related error messages to appear during enrollment.

SCM-13380

Fixed an issue where startup without SCM connectivity caused the CA console to hide existing certificate templates and delete the assigned template list when attempting to add a new one.

SCM-13922
For earlier releases, see MS agent release notes.

Orchestration gateway v1.0

Introducing Sectigo Orchestration Gateway (SOG), a lightweight orchestration layer that extends SCM into operational environments. It provides a consistent way to execute certificate lifecycle tasks across hybrid and multi-cloud infrastructure, reducing reliance on custom scripts, manual steps, and environment-specific integrations.

Used alongside SCM, SOG orchestrates discovery, issuance, renewal, deployment, and revocation using standardized workflows. Its modular, extensible architecture is designed to support high certificate volumes, short renewal cycles, and evolving platform and cryptographic requirements, without adding significant operational overhead.

Key capabilities:

  • Orchestration of the full certificate lifecycle across different environments

  • Endpoint-based key generation with no shared or centralized key storage

  • One-to-many automation from a single gateway instance

  • Local and remote server/endpoint support using SSH, WinRM, and multiple authentication methods

  • Integration with local credential stores and enterprise vaults, including HashiCorp Vault, CyberArk Vault, and Delinea Secret Server

  • Support for Apache, Tomcat, Microsoft IIS, F5 BIG-IP, Nginx, and file-based endpoint types including PKCS#12, JKS, and PEM

SCM v26.3

This release of SCM Enterprise includes the following updates and improvements:

General updates

Change Reference number

You can now create PQC Private CAs using the ML-DSA algorithm. These CAs support ordering PQC private SSL, client, and device certificates for post-quantum learning and testing.

For more information, contact your Sectigo account manager.

SCM-13582

The Usage page has been redesigned to show overages more clearly and indicate how inventory from flex bundles is used.

SCM-13724

The DNS Connector will now generate TXT records in DNS instead of CNAME records. This change is backwards compatible with existing DNS Connector releases.

SCM-13600

REST API Enhancements

Change Reference number

The API now has a new resource to get usage details.

SCM-13724

Resolved issues

Issue Reference number

The approver and requester can now be included in notifications for device certificates.

SCM-13336/ SCM-12916

SSL certificate deletion events are now audited.

SCM-13469

SCM now uses Azure Key Vault API version 2026-02-01 since all previous versions will be retired in early 2027.

SCM-13595

Admins can now validate their emails in SCM.

No features require a validated email at this time.

SCM-13757
For earlier releases, see SCM Enterprise release notes.

Network agent v5.5

This release includes the following general updates:

Change Reference number

Improved script that collects IIS server information to operate on Windows desktop operating systems that don’t have required IIS features installed.

SCM-12839

Resolved issue of installation of wildcard certificates to Apache servers from a Network Agent installed on Windows that would fail with an error saying “The filename, directory name, or volume label syntax is incorrect”.

SCM-12874
For earlier releases, see Network agent release notes.

Private key agent v2.3

This release includes the following general updates:

Change Reference number

On some systems, the agent would fail when generating CSR and key.

SCM-9723

Improved performance when processing large numbers of key generation requests.

SCM-11056
For earlier releases, see Private key agent release notes.

CA connector v3.5

This release includes the following resolved issues:

Change Reference number

The Sectigo CA Connector 3.4 installer was reporting itself as 3.3.

SCM-13345

Discovery of certificates in DigiCert found no certificates if the account contained a multiple of 20 certificates.

SCM-13287

There was a missing space between review_requests and create_longer_validity_order when describing missing DigiCert API permissions.

SCM-11284
For earlier releases, see CA connector release notes.

DNS connector v1.3

This release includes the following updates and improvements:

General updates

Change Reference number

There is now support for the CSC Basic DNS via the CSC Domain Manager platform.

SCM-10304

Resolved issues

Change Reference number

Connector could not remove the CNAME record from AWS.

SCM-13566

Problem with provider initialization during stale records cleanup.

SCM-13574
For earlier releases, see DNS connector release notes.