What’s new?

Support for GlobalSign for issuing public SSL certificates.

SCM-13814

Support for EJBCA for issuing private SSL certificates.

SCM-14520

SCEP RA certificates now support automatic issuance from a client certificate profile, making enrollment faster and renewal automated.

SCM-13303

New date formats are available in General Settings.

SCM-10682

Support for configuring Sectigo Orchestration Gateway’s endpoints using the credential store option.

SCM-15120

Persistent Validation DCV validations will now automatically renew every 7 days.

SCM-15339

New option to filter domains by DCV method.

SCM-15363

Improved handling of MS Agent disconnected notifications if the agent fails to send heartbeats but is performing other actions. Only the first notification will be sent until a heartbeat is received.

SCM-15704

Improved filtering options on Admin REST API.

SCM-14184

Moving a private key to another Network Agent instance might have failed if other key migrations were already in progress.

SCM-15561

Enrollment using EST endpoint might have failed if the account URI contained uppercase characters.

SCM-15523

Occasionally, when editing a certificate profile for an external CA such as MS CA, a warning about the template no longer being available would appear.

SCM-15435

Mark certificates orders might have remained in the applied status even after issuance by the CA.

SCM-15403

Assigning an SSL certificate to a department via API would have failed to validate the department that had delegated access to the certificate’s domains.

SCM-15171

If the requester for a code signing certificate had a name longer than 64 characters, the request was submitted to the CA but not recorded in SCM.

SCM-14069

CA Connector now supports GlobalSign.

SCM-13814

CA Connector now supports EJBCA.

SCM-14520

Support for Entrust has been deprecated.

SCM-14886

The Manage CA permission for Microsoft CA is no longer required.

SCM-15548

SOG can now discover and renew certificates on Palo Alto PAN-OS firewalls and Panorama through the PAN-OS management API. Certificate installations are committed automatically, and from Panorama they are pushed to member devices. No separate restart step is needed.

SCM-14774

SOG can now discover, enroll, renew, and install certificates on Akamai CPS. It works with existing and new CPS enrollments and supports RSA or ECDSA keys. The private key stays in Akamai CPS. SOG uploads the signed certificate, binds it to the Enhanced TLS edge hostname and activates the property. Endpoints are configured with EdgeGrid credentials, and requests can optionally go through the SOG proxy (use_proxy, default off).

SCM-14596

SOG’s WinRM client has been replaced with a more capable one that fixes intermittent "401 Invalid Content" and HTTP 400 and checksum errors; supports Basic, NTLM and Kerberos with message-level encryption, and no longer reports a false "restart failed" for successful Windows service restarts. When a WinRM connection fails, SOG now runs checks (connectivity, DNS, port, authentication, Kerberos) and adds specific recommendations to the error shown in the log and in SCM. It also provides improved support for WinRM configuration types.

SCM-15219 SCM-15114 SCM-15572 SCM-15279 SCM-14470 SCM-14577 SCM-14720 SCM-15400 SCM-15526

Proxy support in SOG has been improved. With the exception of HashiCorp Vault integration, proxy settings are now consistently applied. HashiCorp can only be configured using environment variables instead of the standard --use_proxy option when configuring the endpoint.

SCM-15411 SCM-15364

SOG can now manage Nginx with a non-root account over SSH or locally by running the Nginx commands through sudo. The account requires a sudoers entry for those commands and write access to the Nginx config location (root works as before).

Installing a certificate no longer restarts Nginx automatically.

The endpoint reports "Restart Required" and Nginx restarts only when SCM sends a restart command.

SCM-15514 SCM-15204

SOG can now add and discover Citrix ADC appliances that only offer older TLS ciphers, using the new use_legacy_rsa option on the Citrix endpoint, so initialization and node discovery no longer fail with the misleading "nsversion" error.

Citrix endpoints can also route traffic through the SOG proxy with use_proxy. Endpoint hostnames are now validated and supported schemes, ports, and paths are rejected with a clear validation method.

SCM-15372 SCM-15439 SCM-15511 SCM-14893

SOG can now discover and renew the certificate used by the F5 management interface (TMUI / iControl REST). The new certificate becomes active after an httpd restart, which you control with SCM’s "Restart After Installation".

F5 endpoints can also be added on a non-default management port with tls add f5 --port.

Each phase is logged by discovery.

SCM-13963 SCM-14062 SCM-15294

Cloudflare endpoints can now use the HashiCorp Vault credstore.

Cloudflare insecure mode now honors the proxy.

SCM-15019 SCM-15635

F5 discovery no longer hangs at 100% CPU, leaving the endpoint stuck in INIT, when a virtual server uses a profile whose certificate is a CA certificate (such as BIG-IP’s stock /Common/clientssl profile).

A virtual server with a malformed destination now returns an error instead of crashing the agent.

SCM-15391 SCM-14088

Certificate renewal now succeeds on IIS sites with several matching HTTPS bindings (for example a non-SNI binding plus an SNI binding on port 443).

Every matching binding is updated instead of the install failing.

SCM-15526

Discovery of large Imperva accounts is significantly faster (one keystore lookup per account instead of one per site) and no longer drives CPU to 100%.

SCM-15392

Syncing sites with long domain names using Imperva no longer fails in SCM, so all discovered sites appear in the node list.

SCM-15230

CyberArk credentials now work for discovery and enrollment, reported errors are clearer, and use_proxy is honored.

SCM-15420 SCM-15633

Resolved Apache Tomcat issues: Linux keystore permissions and restart-script launch; and removed false restart failures over WinRM.

SCM-15114 SCM-15087

Apache on RHEL 8.3 no longer fails to restart after certificate deployment.

SCM-13895

Improved handling of discovery of nodes when one agent is connected to large number of servers.

SCM-14157

Improved handling of CSR generation if network issues interrupted initial request.

SCM-13717

Improved rewriting Tomcat <Connector> to <SSLHostConfig> elements so that all deprecated attributes are dropped.

SCM-14794

Upload of certificates to remove Linux targets from Windows agent would result in error 110.

SCM-14153

When using the Docker-based Network Agent, logs to stdout would stop after the internal log file was rotated.

SCM-14488

Added support for:

SCM-14312

Added support for F5 Big IP 17.5 and 21.

SCM-14313

Updated third-party components to address the following vulnerabilities:

SCM-14662

SCM now supports network discovery tasks using a configured Sectigo Orchestration Gateway (v2.0).

SCM-14475

SCM now supports adding and editing Sectigo Orchestration Gateway (v2.0) keystores and endpoints from the UI.

SCM-14395 / SCM-14396

Improved filtering of Sectigo Orchestration Gateways and SSL/TLS automation endpoints.

SCM-14383 / SCM-14384

New notification for offline Sectigo Orchestration Gateways.

SCM-14386

Sectigo Orchestration Gateways can be managed via the SCM Admin REST API.

SCM-14461

Updating a certificate’s metadata via API would fail if the certificate’s initial term was no longer allowed in the certificate profile.

SCM-14133

Inventory exceeded notifications might be sent when the usage exactly matched inventory.

SCM-14620

SSL certificate reports created via API did not include the IP address column even when requested.

SCM-13074

Assigning certificates from a bucket to an organization/department might not process all certificates if some certificates had been processed already.

SCM-14434

The DNS connector now supports LEGO DNS providers, including all providers available up to LEGO version 4.31. These providers are bundled with the DNS connector and can be used with the lego provider type.

SCM-13509

Starting with DNS connector 1.3, created entries for Cloudflare, DNSimple, and OVH would not be deleted after validation was complete.

SCM-14297

The performance of the Certification Authority snap‑in has been enhanced, resulting in much faster loading and navigation of issued certificates in high‑volume deployments.

SCM-13143

There is improved HTTP proxy compatibility by including the port number in the CONNECT request as well as the Host header.

SCM-12270

Startup no longer converts CA private keys to non‑exportable by default; this can be enabled via the PrivateKeyNonExportable registry setting.

SCM-13903

Fixed a regression in MS Agent 4.3 that caused certificate requests to fail for Active Directory Certificate Templates requiring manual SAN entry.

SCM-12534

Improved handling of network loss during initialization, which previously resulted in logging the error "The specified domain either does not exist or could not be contacted."

SCM-12995

Fixed an issue where CA names containing spaces were parsed incorrectly, preventing the CA’s AD Configuration container from being located during discovery.

SCM-13187

Resolved an issue where conflicting error codes caused incorrect permission‑related error messages to appear during enrollment.

SCM-13380

Fixed an issue where startup without SCM connectivity caused the CA console to hide existing certificate templates and delete the assigned template list when attempting to add a new one.

SCM-13922

Improved script that collects IIS server information to operate on Windows desktop operating systems that don’t have required IIS features installed.

SCM-12839

Resolved issue of installation of wildcard certificates to Apache servers from a Network Agent installed on Windows that would fail with an error saying “The filename, directory name, or volume label syntax is incorrect”.

SCM-12874

On some systems, the agent would fail when generating CSR and key.

SCM-9723

Improved performance when processing large numbers of key generation requests.

SCM-11056

The Sectigo CA Connector 3.4 installer was reporting itself as 3.3.

SCM-13345

Discovery of certificates in DigiCert found no certificates if the account contained a multiple of 20 certificates.

SCM-13287

There was a missing space between review_requests and create_longer_validity_order when describing missing DigiCert API permissions.

SCM-11284