Skip to content

Release notes

Changes per version, newest first. Upgrades are cumulative: you can go directly from any version to the latest one (Upgrade), but read the Upgrade notes of every version you skip.

1.9 (to come)

License

  • The license now suspends certificate issuance at its limits, after the alerts. Once the contracted volume is reached, a new name is refused and a name already counted can still be renewed. Above the volume, after the end date, or without a license once the 30-day evaluation is over, issuance and renewal are refused on every channel (interface, API, ACME, EST, SCEP, CMP), with an explicit refusal and the audit event LICENSE_ISSUANCE_REFUSED. Revocation, CRL and OCSP, the appliance's service certificates, license activation, discovery and the deployment of certificates already issued are never suspended. This replaces the earlier rule under which the license never blocked anything (License).

Upgrade notes

  • Check System > License before upgrading: an installation above its volume, past its end date, or without a license after the evaluation will refuse new certificates and renewals as soon as it runs 1.9.

1.8.51 (29 October 2026)

Security

  • The sign-in page no longer shows the installed version; it is shown in the account menu once signed in.
  • The connection test of a certificate authority (/api/v1/pkis/{id}/test-connection) is a POST: it contacts the authority and records the result, so it is no longer reachable with GET (405).
  • After pkifactor-ctl reconfigure, the wizard offers, at the end, to delete the previous configuration file kept aside (.env.before-reconfigure-<date>), which holds the secrets of the previous installation. In headless mode it is kept and a warning gives its path, unless PKIFACTOR_DELETE_OLD_ENV=1.
  • Kemp: a network or TLS error on the /accessv2 interface is reported as a clean connector error.

Interface

  • Messages that still appeared in French in the other languages are translated: configuration errors of the Linux server (SSH) target, the note of the F5 connection test, the Certificate Transparency summaries and errors on the Monitoring page.
  • Domain validation statuses and the remaining time of a PKCS#12 download are translated.
  • Texts that still spoke of a licence quota for users or imported certificates are corrected.

1.8.50 (29 October 2026)

Security and reliability

  • CMP and SCEP: a request refused by an issuance policy gets an explicit refusal (CMP rejection with the reason in the status text, SCEP badRequest) instead of a server error. The reason is recorded in the audit trail.
  • CMP: error responses carry the right failure codes (badCertTemplate, badDataFormat); one of them was sent with the code of an integrity error.
  • Certificate Transparency alerts sent to ServiceNow are accepted: they need version 1.0.1 of the PKIFactor application for ServiceNow, which replaces 1.0.0 (ServiceNow).
  • A revocation ordered from ServiceNow works again with the revocation comment introduced in this version.

Installation and operations

  • Kubernetes and OpenShift: the Helm chart passes the proxy secrets to nginx, which did not start since 1.8.46 (OpenShift).
  • pkifactor-ctl tls update accepts ECDSA certificates and checks that the key matches the certificate for RSA and ECDSA alike.
  • pkifactor-ctl reconfigure --keep-data changes the network, the domain or the TLS certificate and keeps the database, the keys, the secrets and the license. Without --keep-data, a full reset must be confirmed by typing ERASE, and the previous .env is always kept next to the new one (Appliance installation).

Interface

  • Session Timeout (System > Settings) now sets the session length; the default stays 30 minutes. The log format is no longer shown as a setting: it is set at installation with PKIFACTOR_LOG_FORMAT (JSON by default).
  • PKI Connectors: a Test connection action records the state shown in the list.
  • CSR Generator: DNS:, IP: and email: prefixes are accepted, as the help says; validation errors are readable.
  • The revocation comment reaches the audit trail and is shown to the approver.
  • Enrollment kits for EST and SCEP are offered on a profile even when ACME is off.
  • The sign-in page shows the installed version. Texts that were still in French in the other languages are translated.

Upgrade notes

  • Check the session length after the upgrade. Until 1.8.49, the session lasted 30 minutes whatever Session Timeout showed (it was set by JWT_EXPIRE_SECONDS). The setting now applies. If an administrator ever saved the System > Settings page, it holds the value shown at that time, 60 minutes by default, and sessions now last that long: set it back to 30 if that is what you want. A value that nobody ever saved is brought to 30 automatically.
  • ServiceNow: import version 1.0.1 of the PKIFactor application to receive Certificate Transparency alerts.
  • Kubernetes and OpenShift: with GitOps or helm template, provide secrets.estProxySecret and secrets.mtlsProxySecret; an existingSecret must contain both keys.

1.8.49 (28 October 2026)

Security

  • Renewing a certificate with your own CSR is reserved to its owner and the members of its team, under the same conditions as downloading its private key. An administrator or an operator who is not in the team renews with a key generated by PKIFactor (Renew a certificate). This also applies to renewals ordered from ServiceNow.
  • Kemp LoadMaster: the API key no longer appears in the address of any request (it could be read in the logs of the device or of a proxy). It travels in the body of the requests.

Interface

  • Device bindings use the vocabulary of each device: decryption rule (Palo Alto Networks), virtual service (Kemp), IIS site, server policy (FortiWeb), server certificate object (Check Point). These devices have a single field; F5 BIG-IP keeps its virtual server and its profile. When the service account cannot list the objects, the name is typed in.
  • A request, a renewal or an approval refused by an issuance policy gives the reason of the rule, instead of the code POLICY_VIOLATION.

1.8.48 (28 October 2026)

Security

  • Palo Alto Networks: the password no longer appears in the address of the key request, nor the API key in the address of the other requests, and a connection error no longer repeats them. Every device connector masks passwords, keys and tokens in its error messages.
  • Redirecting a device pauses all the bindings attached to a certificate or a group, whatever the key mode, and changing the renewal settings of someone else's certificate is refused, administrators included.
  • Automatic renewal, immediate renewal and key generation on a device keep the owner of the original certificate; the person who acts is recorded as the requester.

Installation

  • First-boot assistant: the administrator password is masked while typed; the network step lists only real interfaces; Docker output goes to /var/log/pkifactor-setup.log instead of the screen; MTLS_PROXY_SECRET is written even when EST is not enabled.

Interface

  • The License page shows no tier figure; translations no longer show HTML tags as text; field examples use host names instead of addresses.

1.8.47 (28 October 2026)

Licensing

  • One edition, every function included. The license states the number of managed certificates covered by the contract and never blocks anything: PKIFactor sends alerts at 80, 90 and 100 % of that volume and before the end date, records a monthly peak and exports a signed usage report (License).
  • Licenses issued before this version keep working. A key that was not limited in volume stays unlimited, without percentage or alert.

Interface

  • Request, renewal and device-binding forms offer the key algorithms that the profile, the authority and the issuance policies actually allow. A renewal proposes the algorithm of the certificate being renewed when it is still allowed: an ECDSA certificate is no longer renewed in RSA by default.
  • Texts that were still fixed in one language are translated; French labels no longer use em dashes.

Security

  • A renewal that changes the identity of a certificate (common name, or names outside those of the original certificate) goes through approval when an issuance policy requires approval for those names, as a new request would. A renewal with the same identity stays automatic.
  • On a device, turning TLS verification off or removing the trusted CA requires the credentials to be entered again, as a change of host does.
  • The client-certificate headers and the client address that nginx passes to the interface and the API carry a proof shared by nginx, the interface and the backend (MTLS_PROXY_SECRET). The client-certificate sign-in modes (dual, required) work the same way in single-node and high-availability installations.

Fixes

  • EST /simplereenroll answers normally (it returned an error 500 although the certificate was issued, so clients retried). A request refused by the profile (for example an EC key on an RSA-only profile) is answered with an error 400 that states the reason.

Upgrade notes

  • Appliance: pkifactor-ctl upgrade generates MTLS_PROXY_SECRET when it is missing. Docker Compose installations: add MTLS_PROXY_SECRET (a long random value) to .env and pass it to the nginx service, as for EST_PROXY_SECRET (Docker Compose).
  • High availability: the PostgreSQL superuser password is now mandatory. On a cluster created before 1.8.30 that never ran pkifactor-ctl ha-db-passwords, run it before the upgrade, then upgrade as usual. Otherwise the upgrade sets the password itself and asks for the leader to be upgraded first (High availability).

1.8.46 (28 October 2026)

Security

This version gathers the corrections of an external security review of the whole product.

  • Deployment: changing the address, port, transport, TLS verification, account or commands of a device that already holds bindings pauses the bindings that push a private key; only the owner of the certificate (or their team) resumes them, from the certificate page. A paused binding keeps that reason until the owner resumes it.
  • Binding someone else's certificate to a device, provisioning it on the device or renewing it there is reserved to the owner of the certificate and their team, whatever the key mode.
  • A renewal keeps the owner of the original certificate; the person who renews is recorded as the requester.
  • Sign-in sessions end at the latest after 12 hours (JWT_MAX_SESSION_SECONDS); a password reset ends the other sessions; an identity provider's e-mail is trusted only if verified, or if the provider is marked as trusted.
  • Enrollment gateways: CMP limits the cost of password-based protection and refuses a replayed message; ACME validates DNS challenges without blocking the service and with time limits; EST checks that the headers come from nginx (EST_PROXY_SECRET) and that a renewal keeps the identity of the client certificate; SCEP checks the message digest and refuses a replayed request.
  • Appliance package: pkifactor-ctl upgrade requires a valid signature with the key installed on the host and refuses to install an older version.

Interface

  • Error messages coming from the API are translated into the five languages of the interface.
  • Dashboards: the Pilot space is a control centre (failures first, each figure opens the list it counts), administration starts with the health of the platform, and the certificate cycle reads Issued, Deployed, Verified.
  • E-mails: a rejected request is notified to the requester, a revocation to the owner with the name of the person who revoked, pending revocation requests to the validators. Templates are in their third generation and in five languages.
  • The Team Email of a profile is used only for automated certificates; a request from the interface is pre-filled with the requester's team.

Upgrade notes

  • Defaults that change: CMP end-entity requests are bound to the subject of the signer (CMP_EE_FREE_SUBJECT=1 restores free subjects); SCEP refuses DES and MD5 (SCEP_ALLOW_LEGACY_CRYPTO=1 accepts them); ACME no longer finalizes an order on a GET of the certificate.
  • E-mail templates you customized in the previous generation are kept; reset them to the new generation (Email Settings, panel Email Templates, Manage) to benefit from the new texts (E-mail and notifications).
  • Docker Compose installations: set EST_PROXY_SECRET in .env and pass it to nginx and EST. The appliance generates it at upgrade.

1.8.31 to 1.8.45 (26 to 28 October 2026)

New

  • Certificate Transparency monitoring: watched domains, custom detection rules, look-alike domains and a real-time feed, with alerts (Certificate Transparency monitoring).
  • Roles: the administrator is the only global role (the former super administrator is merged into it) and the platform keeps at least two active administrators. The operator becomes a delegated administrator of their organizations, with adjustable permissions and access to the devices entrusted to them only (Users and roles). The auditor sees the whole estate by default, or only their organizations.
  • Private keys: exporting a PKCS#12 is reserved to the owner of the certificate and their team; in the browser the PKCS#12 is protected with AES-256 by default.
  • Approvals: an administrator decides only if they are also a validator of the organization; any decision outside one's own authority requires a reason and is recorded.
  • Interface: menus split into the RA space (operations) and Administration (platform); lists with columns to choose and per-column filters; dashboards where each figure opens the list it counts.

Security

  • SSH devices: no authenticated connection before the host fingerprint is validated; a fingerprint is never taken from a request and is erased when the host or port changes.
  • Each device connector declares which settings change its destination; changing one of them counts as a redirection.
  • Dependency update: dnspython 2.9.0.

1.8.30 (26 October 2026)

Security

  • Appliance backups (pkifactor-ctl backup) are encrypted (gpg, AES-256, with an integrity check). The archive holds the database dump and the keys that decrypt it; it used to be protected only by its file mode. The passphrase is kept outside the archive, in /etc/pkifactor/backup.pass, generated by the first backup (Backup and restore).
  • High availability: the PostgreSQL superuser and the Patroni REST API have their own passwords. They used to share the application's database password, so a leak of that password gave superuser access on port 5432 of every node. New clusters get them from ha-init; existing clusters use pkifactor-ctl ha-db-passwords (High availability).

Fixes

  • EST server-side key generation (/serverkeygen) works: the response carries the private key (PKCS#8) and the certificate (PKCS#7) as RFC 7030 describes, and the key uses an algorithm allowed by the profile. Before, the request failed with an error 500 while a certificate was issued.

Upgrade notes

  • After the upgrade, take a backup and copy /etc/pkifactor/backup.pass to your password vault: archives made from now on cannot be restored without it. Older unencrypted archives remain restorable.
  • On a high-availability cluster, run pkifactor-ctl ha-db-passwords once (leader first, then the other nodes).

1.8.29 (26 October 2026)

Security

  • Sign-in rate limit and audit trail use the address of the real client. Before, every sign-in through the interface came from the same internal address: the limit of 10 attempts per minute was shared by all users, and sign-in events recorded the internal address.
  • The certificate of the SMTP server is verified (STARTTLS and SMTPS). A relay with a private CA must be trusted by the host, or SMTP_TLS_INSECURE=1 restores the previous behaviour.
  • The user recorded in the technical logs comes from the verified session, never from a value sent by the browser.

Fixes

  • Deployment: a key on the device binding is refused at configuration on IIS, Kemp, FortiWeb and Check Point, which cannot generate keys; the binding form offers only PKIFactor generates the key for them.
  • ACME: saving the Settings page no longer empties acme_allowed_networks; the enrollment kit no longer offers TLS-ALPN-01, which it cannot generate.
  • CSR Generator: the subject alternative names typed are written into the CSR.
  • ServiceNow Update Sets: no default values from the test environment.

1.8.28 (26 October 2026)

New

  • Windows and IIS: JEA mode. The deployment account no longer needs to be an administrator of the server: it connects to a restricted PowerShell endpoint, installed by a script provided with PKIFactor, where only the functions needed for deployment are visible. The endpoint refuses to delete a certificate that PKIFactor did not import or that is still bound to a site (Windows and IIS).
  • Deployment target forms: fields shown in a consistent order, closed lists for fixed choices, target type translated.

Security

  • Windows and IIS: the PFX file and its password are no longer written into the PowerShell script sent to the server, so they no longer appear in the server's script block logging nor in PKIFactor's logs. The import keeps the leaf certificate that carries the key.

1.8.27 (26 October 2026)

  • Deployment targets: dedicated form fields for PAN-OS, Kemp, Check Point and Windows/IIS.
  • Windows and IIS: the CA certificate of the WinRM listener can be pinned on the target (ca_cert), so that the server's identity is verified.

1.8.26 (26 October 2026)

Fixes

  • High availability: ha-init stops the single-node services before switching; ha-join waits until the database replica is healthy before starting the application services; no secret is read from .env by the high-availability services any more.
  • etcd witness: clear instructions on the certificate files to copy (never the CA key).
  • Restore on a new host: the database role passwords are realigned with the restored configuration.
  • Setup wizard: unattended mode works without the dialog package.
  • Revocation: a free-text reason (API, ServiceNow catalogue) is sent to the authority as unspecified and kept as text in PKIFactor. Before, AD CS rejected it and the certificate stayed valid at the authority while marked revoked in PKIFactor.
  • Backups: the S3 storage type is greyed out and refused, since it is not available in this version; previously the failure only appeared when the backup ran.

1.8.25 (26 October 2026)

New

  • Public REST API under /api/v1, with interactive documentation (/api/v1/docs, /api/v1/redoc) (REST API).
  • ServiceNow: application and catalogue delivered as Update Sets; profiles that need no approval are listed first, with a counter.

1.8.24 (26 October 2026)

  • ServiceNow: language of the ticket notes can be set (English by default, or French); catalogue available in English or French.
  • ServiceNow: recovery after an outage of either side, revocation confirmed on the right ticket, origin of the approver shown.

1.8.23 (26 October 2026)

New

  • ServiceNow: the status of a request is written back to the ticket through a note API, which needs no read access to tickets.

Fixes

  • Appliance: the setup wizard creates the application database role without superuser rights; the services no longer connect to the database as superuser.
  • Appliance: secrets are kept in files under /opt/pkifactor/secrets/ on every path (new installation, upgrade, high availability, backup).
  • Appliance: on a high-availability node, upgrade installs the high-availability service definitions instead of the single-node ones.
  • Setup wizard: the default administrator e-mail matches the backend's, and the initial password is removed from .env once the account exists.
  • The banner showing the initial administrator password is in English and French.
  • pkifactor-ctl help lists license request.
  • Kubernetes and OpenShift chart: main Secret rendered correctly with a KMS, secrets mounted outside /run/secrets (OpenShift), retention 0 accepted; the air-gapped values example is corrected.

1.8.21 and 1.8.22 (25 October 2026)

  • F5 BIG-IP: a certificate object shared between several SSL profiles is detected before deployment (supervised switch) and reported after a rotation (alert DEPLOY_PREVIOUS_CERT_STILL_SERVED, ServiceNow incident).
  • F5 BIG-IP: two objects with the same name in different partitions are no longer confused (verification, reconciliation, adoption).
  • Device logos updated to the vendors' current official marks; Drift translated in all five languages.
  • Kubernetes and OpenShift chart: KMS credentials in a dedicated Secret mounted as files, with an option for an external secret store (CSI).

1.8.20 (25 October 2026)

New

  • License counted in distinct common names: renewals and the members of a crypto-agile group count once; a name already counted is never blocked by the quota. Counter on the administrator dashboard and on the license page (License).
  • Device logos on deployment targets.

Security

  • KMS credentials and the previous token signing key are read from files by the backend, the worker and the ACME and EST gateways; each service receives only the secrets it uses.

1.8.18 and 1.8.19 (25 October 2026)

  • Incident logging: each error is classified by origin (product, third party, network, configuration) and carries a reference that follows it from the screen to the device; repeated messages are collapsed. State of the PKI connectors, security log over several days.
  • Failed bindings always say why: cause of the last failure with its date, technical detail and repair options, including the case of an object missing from the device inventory.
  • Clearer screens for devices and bindings; single confirmation dialogs; counters corrected.
  • The token claims group source no longer mentions SAML, which PKIFactor does not support.

1.8.16 and 1.8.17 (25 October 2026)

  • Interface translation completed for most screens in English, French, German, Spanish and Portuguese.
  • Duplicate organization names are refused explicitly.
  • Microsoft Entra ID: disabled accounts are no longer attached to organizations nor offered in people search.

1.8.15 (25 October 2026)

  • LDAP and Active Directory: nested groups are resolved (recursive Active Directory rule, paginated), cycles handled, disabled accounts excluded, groups of more than 1,500 members read completely.
  • ServiceNow: list of the profiles available to a given requester.
  • Clearer Keycloak error messages.

1.8.14 (25 October 2026)

  • ServiceNow inbound API: the ServiceNow catalogue can request, renew and revoke certificates and read their status on behalf of the requester, with a hashed key, an allow-list of profiles and the status written back to the ticket (ServiceNow).

1.8.12 and 1.8.13 (25 October 2026)

New

  • Organizations and teams: the organization gives read access, the team (within the organization) and the owner give the right to act. Directory groups are linked to organizations and synchronized at sign-in, on schedule and on demand, including nested Active Directory groups and groups without e-mail (Organizations and teams).
  • Organization managers manage the members of their organization (page My organizations), without changing directory-provided memberships.
  • Directory sources: new Keycloak, Okta and Google Workspace sources; forms built from each source type; people search in directories, and memberships waiting for a person's first sign-in (Directory sources).
  • Microsoft Graph: security groups without e-mail and nested members.
  • Profiles: visibility for one organization, a list or all; the certificate's organization is the intersection of the requester's and the profile's. The profile form is reordered by theme, post-quantum algorithms appear only when the authority offers them, and crypto-agility is set by choosing authorities.

1.8.11 (24 October 2026)

Changes

  • Profiles: a value supplied by the requester (form, API or CSR) for a field that is not editable is refused explicitly, instead of being silently replaced.
  • Downloading a PKCS#12 no longer asks for the account password (single sign-on users have none). The download stays audited, rate-limited and limited to users with rights on the certificate.
  • Real overview pages for the RA and Administration views.

Upgrade notes

  • API clients that send subject fields a profile does not allow to edit now receive an error: remove those fields from the requests.

1.8.7 to 1.8.10 (24 October 2026)

  • Discovery workspace, separate from the CLM inventory: certificates found by scans, imports and authority absorption, classified by trust origin and risk, with Take under management that adds a certificate to the inventory without reissuing it (Discovery workspace).
  • Customizable dashboards: each user composes dashboards from indicators, tables and filters (Dashboards).
  • RA view and Administration view for administrators, tabbed dashboard, Operations section in the menu.

1.8.6 (24 October 2026)

  • TLS scanner visible again, outside the CBOM scope, with STARTTLS for SMTP (25, 587), IMAP (143), POP3 (110), FTP (21) and LDAP (389) (TLS scanning).

1.8.5 (24 October 2026)

New

  • Kemp LoadMaster connector validated end to end.
  • ACME: unknown profile answers 404; a renewal is linked to the certificate it replaces.

Security

  • Single sign-on: HTTPS is mandatory towards the identity provider (issuer, token, JWKS and user information endpoints). Sign-in through a provider registered with http:// is refused.

Upgrade notes

  • Before upgrading, change any SSO provider declared with http:// addresses to https://.

1.8.3 and 1.8.4 (24 October 2026)

  • ServiceNow integration: PKIFactor pushes the certificate inventory and events (deployment failures, policy installation needed...) to ServiceNow, which creates incidents or change requests. Settings screen in Administration > Settings > ServiceNow integration.
  • Check Point: session locks, PEM chain and first-password handling; stable naming to avoid collisions on Check Point and PAN-OS.

1.8.2 (24 October 2026)

New

  • New deployment connectors: Palo Alto Networks PAN-OS (least-privilege account), Windows and IIS, Kemp LoadMaster, Check Point (inbound HTTPS inspection, publish and policy installation followed to completion) (How deployment works).
  • Multi-target deployment pipeline: a certificate is deployed to the site first, then to the inspection devices, as one transaction with rollback across targets.
  • Inventory report export in PDF, XML, CSV and JSON; bulk inventory import from a CSV template.
  • API documentation available in production (it can be turned off).

Security

  • Exporting a private key (PKCS#12 download) is recorded in the audit trail (CERT_PRIVATE_KEY_EXPORTED: who, which certificate, serial number, format, address).

1.8.0 and 1.8.1 (22 October 2026)

Changes

  • The cryptographic inventory features (CBOM, posture and recommendations, crypto catalogue) are hidden by default in PKIFactor: they are provided by the separate ZetaCBOM product. The cryptographic attributes of managed certificates stay in the certificate views.
  • Menu reorganized in sections (administration sections collapsed by default), accessibility and wording fixes.

Fixes

  • Revocation checks: the real signer of a CRL or OCSP answer is found through the issuer's AIA; distinct states (good, revoked, invalid signature, missing anchor, unreachable) instead of a generic unreachable.
  • New field per authority, Allowed internal networks (revocation), for CRL, OCSP and AIA URLs on private networks.
  • Certificate details: complete signature algorithm, named EC curve, actual KMS and private key custody.

Security

  • Dependency update (certifi).

1.7 series (18 and 19 October 2026)

  • Crypto-agility with N certificates: a profile can issue a group of certificates for the same entity from several authorities (for example classical and post-quantum), deployed and renewed together; the former two-certificate mode is replaced, with data migration (Crypto-agility and PQC).
  • Pure post-quantum issuance (ML-DSA) with server-side key generation.
  • IP addresses in subject alternative names typed automatically.
  • Subject fields of the profile shown and applied completely.

1.6 series (September to October 2026)

The main additions of the 1.6 series:

  • Deployment to FortiWeb and to Linux servers over SSH (with presets for common services and Java keystores), with verification of the certificate actually served; F5 BIG-IP deployment hardened.
  • ACME server: TLS-ALPN-01, account key change, pre-authorization, IP identifiers, renewal information (ARI); interoperability with cert-manager.
  • EST and SCEP enrollment kits.
  • DigiCert ONE connector, automated domain validation for DigiCert; optional outbound proxy per authority.
  • Scheduled backups and verified restore.
  • Initial administrator password generated at first start, with a forced change at first sign-in.
  • Strict content security policy, verified TLS between high-availability nodes, container images that run without root (Kubernetes and OpenShift), air-gapped image bundle for OpenShift.