Link Search Menu Expand Document

RELEASE NOTE

Certdog - Certificate Management and Automation System

Documentation: https://krestfield.github.io/docs/certdog/certdog.html

Support: support@krestfield.com

Web: https://www.krestfield.com


Version 1.17.0 Release Date: 7th September 2026

Updates

  • ML-DSA (44, 65 and 87) algorithms added. Supported in software and PKCS#11 tokens.
  • ACME tokens now renew dynamically and can be manually refreshed.
  • System URL now resides in the main settings area.
  • Get CRL API calls added.
  • Managed scripts. These can be run as part of workflows or as regular Tasks. Have the ability to utilise the powershell module and can be provided with an API key to call back into the certdog API.
  • Workflows expanded. Now support many more triggers, send Teams messages as well as Emails and can run managed scripts. They can also obtain request approval via a managed script (e.g. verifying a requested fqdn is registered in DNS).
  • Tasks. These can run regular tasks (such as CA sync or TLS scan) by calling a managed script.
  • WebHooks can be used to call out to other services such as Service Management, JIRA etc. from Workflows.
  • Service now starts faster.
  • Clicking on dashboard widgets now takes you to that certificate view.
  • Can now be deployed as a Kubernetes cluster, separating out all components (CRL, OCSP, ACME, SCEP, API, UI and DB).
  • Improvements made to scheduled tasks (e.g. sending of emails) so now handled better in high-availability setups.
  • CRLs for internal CAs can now be downloaded and re-generated from the console.
  • There is now an option to allow users to revoke any certificates they can see, depending on settings.
  • Support for Crypto4A HSM added.

Security Updates

  • CVE-2026-5588 (vulnerability in Bouncy Castle library) resolved.
  • SpringBoot vulnerabilities resolved:
    • CVE-2026-40973, CVE-2026-40975, CVE-2026-40977
  • Multiple Tomcat vulnerabilities resolved (present in versions prior to 10.1.55):

Fixes

  • Approval rejection didn’t URL encode reason.
  • ACME and SCEP aliases now disallow spaces and check for trailing slashes in URLs.
  • Long log entries hid the last three columns.
  • Corrected encoding of ACME EAB key.
  • Conflict when saved searches had the same name resolved.
  • Dashboard would show certs expiring if they had been renewed.
  • An expired CA could still issue a certificate.
  • Resolved where an API token with the same name could not be created for another user.
  • Newlines for ACME returned certs now consistent for all CAs.
  • OCSP ML-DSA signatures corrected.


Version 1.16.0 Release Date: 26th January 2026

Updates

  • ACME interface added
  • SCEP interface added
  • System URL now resides in the main settings area
  • Get CRL API calls added

Security Updates

  • None

Fixes

  • Fixed issue where a KeyVault CA failed to process a CSR
  • Fixed issue where emails were not being sent


Version 1.15.1 Release Date: 9th October 2025

Updates

  • None

Security Updates

  • None

Fixes

  • Fix for when Idp returns empty number once.


Version 1.15.0 Release Date: 26th September 2025

Updates

  • OAUTH support added so external IDPs (e.g. EntraID) can now be used for authentication
  • CSRs that do not contain a DN entry are now accepted, as long as they have a SAN

Security Updates

  • All vulnerabilities in the UI now rectified

Fixes

  • Fix for when, in certain circumstances the UI would not navigate to the issuer (c20-160).

Version 1.14.0 Release Date: 8th June 2025

Updates

  • CAs can now be revoked from the CA (rather than the certificate only). This also disables the CA
  • A new Dashboard has been added
  • The main certificate view now also shows the certificate status

Security Updates

  • None

Fixes

  • Users can now revoke their own API tokens (but cannot create). This was preventing the user from viewing their own profile in some cases.
  • Introduced at V12 - OCSP server failed to renew certificate as was running a version behind main server. Now corrected.

Version 1.12.0 Release Date: 8th May 2025

Updates

  • Several internal improvements
  • API tokens can now be assigned labels and revoked
  • More certificate search options added to PowerShell module
  • User ID and Team IDs now available to copy from main screens

Security Updates

  • Several components upgraded to the latest versions due to minor vulnerabilities detected

Fixes

  • Fixed UI issue when navigating to issuer and revoking. Where message would be incorrect
  • A custom extension marked critical was not always displayed as such in the UI (though it was set)
  • Fixed several certificate search issues
  • If an approval is required when requesting via a CSR a red dialog was shown. This is now grey
  • Only 10 SAN entries were being displayed in the UI. Now can display an unlimited number

Version 1.11.1 Release Date: 26th July 2024

Updates

  • None

Security Updates

  • None

Fixes

  • In certificate details, Renewed By and Renews links had stopped working
  • Corrected revocation approval where approval notification appeared when none was required

Version 1.11.0 Release Date: 24th May 2024

Updates

  • Workflows are now available enabling breaks in processing of certificate requests and revocation requests. Approvals can now be requested as well as call outs to custom scripts

  • There are now options to set the key usage and enhanced Key usage extensions as critical or not

  • UI improvements

Security Updates

  • None

Fixes

  • Fix for UI error when the RSASSA-PSS algorithm was used

  • Corrected error when saving a search for certs expiring in, when status specifically set to Active

  • Fixed issue where you could not set CRL URL for an OCSP responder

  • Users can now view CA certificates. Previously you needed specific permissions to do this

  • Fixed issue where CSR check would show a thumbs up but be invalid

  • If a custom extension was marked critical, the critical part was not shown in the UI after saving (although still functioned correctly), this has now been corrected

  • When requesting a certificate, if you entered a SAN before the DN the request button was not enabled. Now operates correctly.


Version 1.10.0 Release Date: 28th July 2023

Updates

  • OCSP can now be configured to return unknown or revoked if certificate not issued by the CA

  • API updated to force CRL generation and return the CRL

  • CA serial numbers can now be configured to be sequential or random

  • Added support for Yubi HSM 2 as a key store

  • API tokens can now be issued for users, removing the need for applications to login with a username/password

  • There is now an option to omit CRL and OCSP AIA extensions in a certificate profile. For example, if the profile is to be used for OCSP signing

  • Custom extensions can now be added to certificate profiles

  • CAs can now be taken offline, preventing any processing until marked as online again

  • Cert issuers can now be configured to allow or deny DN requests

  • Cert issuers can now be configured to allow only specific CSR generators

Security Updates

  • Additional logging added indicating changes made to user accounts and teams
  • IP address restrictions enforced for every API call (previously only at logon) and can be updated dynamically


Version 1.9.0 Release Date: 23 February 2023

Updates

  • DN Restrictions added. Admins can restrict what DNs can be requested including denying wildcards
  • For Local CAs - CRL can now be specified as the filename (with CDP and local filename auto updating)
  • OCSP server supports other CAs if CRL location is provided
  • Now have the option to ‘go to issuer cert’ for all certificates

Security Updates

  • None

Fixes

  • If you chose to download the issuer of a CA cert you would get the same CA certificate. Now get the correct issuer


Version 1.8.0 Release Date: 21 November 2022

Updates

  • Windows installer improved. Can now be run as a single PowerShell command
  • AD CS Agent updated (now version 1.5) to obtain CA certificates more reliably
  • AD users can now login with username, domain\username or username@domain
  • Principal Name can now be added as a SAN
  • Reverse DN option added to API for Local CAs for cases where the DN in a provided CSR is in reverse
  • OCSP server added for local CAs
  • P7 data now downloaded in PEM format (previously base64 with no headers)

Security Updates

  • None

Fixes

  • If a certificate had expired it showed a negative value for days to expiry. Now shows expired information correctly

  • Local Root CA no longer displays AIA Cert Location, as this was redundant

  • Could not uncheck the add as a DNS SAN option

  • If a CA was imported the DN encoding between issued certificate and issuer could be different meaning some systems would not build a path. Issuer encoding is now duplicated in the issued certificate

  • OK button not enabled until name changed when adding a Microsoft Issuer


Version 1.7.0 Release Date: 5 May 2022

Updates

  • Active Directory integration added to allow AD users to authenticate with permissions managed via AD group membership

  • Last login time and last IP address added to users

  • Users can be emailed an initial password for logon

  • A password policy can now be applied for local users

  • Admins can force users to change password on first use

  • EC curve secp256k1 removed as obsolete

  • Updated to support jdk17

Security Updates

  • SpringBoot updated to version 2.6.6 (CVE-2022-22965)
  • Log4J updated to version 2.17.2

Fixes

  • If you set a Credential for a Microsoft CA Issuer, you could not revert back to No Credential (if you decided to run the service under a specific account)

  • An error was thrown from the ADCS Agent when attempting to run under a service account

  • Log search did not show a time stamp for log entries from the ADCS Agent (though were present when exported and in the main log view)

Version 1.6.0 Release Date: 14 February 2022

Updates

  • Certificate details now displays: key size (or curve name), thumbprint, policies, AIA and CDPs

  • Revoked certificates are now displayed with a red outline

  • Credentials cannot be deleted if in use

  • When installing, the port can now be specified as well as the listening IP address

  • CRLs are now hosted on an http site by default (previously they were https by default)

  • Certificate search now retains number of certificates to display

  • Additional email addresses can be added for cert issued and expiry reminder emails

  • Emails can be suppressed for individual teams

  • Saved searches are now available via a drop down and the search is executed as selected

  • DN can now be entered as components (CN, O, OU etc.)

  • Email sending can be switched off per server (in the case of multiple servers running)

  • Admin users can navigate to team and user details from detailed certificate view

  • Can now control access via IP address (including ranges and wildcards) per team

  • Existing CA imports via PFX/P12 improved

  • Microsoft CA certificate import improved and now stores template with certs when imported

  • More efficient handling for large numbers of certificates (20k+)

    Security Updates:

    • Log4j2 version upped to 2.17.1
    • User disable and delay added for failed login attempts

Fixes

  • When Active selected in search - all certificates were returned
  • If a CA P12 import password used the ‘£’ character import failed. This was due to encoding in the PowerShell module
  • The Certdog service failed to locate the API location on some installations (requiring a workaround)
  • P12 Import occasionally failed when mapping to a Key Store that had non-ASCII passwords
  • Once a Local CA is using a Key Store, the password could still be changed - this is now prevented
  • Import Cert for a user (not admin) would produce an unauthorised response
  • ADCS driver required a credential with local logon. This is no longer needed

Version 1.5.0 Release Date: 15 November 2021

Updates

  • The CA keys and certificates from existing ADCS (Microsoft CA) instances can now be migrated to Certdog, Including CAs using nCipher HSMs
  • Local CAs can now be configured with specific Path Length constraints
  • Local CA Cert Profiles now support the Basic Constraints extension
  • Local CA and Cert Profiles now include the Certificate Policies extension
  • A Sub CA CSR can now be generated for signing from an external CA
  • Local CA CDP and CRL locations are now pre-populated
  • The issuer certificate can now also be downloaded separately
  • Certificate Profiles now have drop-down helpers - to select the most common key-usages etc. for a particular certificate type
  • Certificate owners and teams can be changed via the UI
  • Certificates can now be renewed rather than having to issue new
  • Renewal URLs can now be included in expiry reminder and cert issued emails
  • Filtered logs can now be downloaded
  • Expiry monitoring can be disabled for a specific certificate
  • My Issuers added - where users can obtain CA certs for the issuers they are permitted to use

Fixes

  • Cert chain (p7b) now also includes the end-entity certificate
  • Unchecking all key usages in a Certificate Profile was not permitted. Now allowed
  • If a certificate had no team an error was sometimes thrown when searching for certificates
  • Certificate default search was set to not default when saved. Setting now retained

Version 1.4.1 Release Date: 6 August 2021

Updates

  • Logging can now also be directed to any log4j2 supported appender
  • Force delete of key stores and local CAs added

Fixes

  • None

Version 1.4.0 Release Date: 19 July 2021

Updates

  • Local CAs can now utilise the follow key stores:
    • PKCS#11
      • including Thales Luna, AWS CloudHSM and Utimaco
    • Azure Key Vault
    • Google KMS
    • PKCS#12 (Software)
  • Key stores, issuers and local CAs can now be recovered if accidentally deleted

Fixes

  • None

Version 1.3.0 Release Date: 17 June 2021

Updates

  • You can now build a hierarchy of Local CAs - with any path length
  • Local CAs now produce CRLs
  • Local CAs now include AIA and CDP extensions
  • Certificates can be deleted from the Console
  • Email reminders may be switched off for specific certificates
  • Certificates can now be imported
  • Other CAs can now be imported as a Local CA if provided as a PKCS#12
  • OCSP No Check extension now available in cert profiles

Fixes

  • If email server settings were incorrect there would be a delay in obtaining a certificate (whilst the connection timed out). Emails are now sent in a separate queue

Version 1.2.0

Release Date: 25 March 2021

Updates

  • Users are now associated with teams
  • Administrators can decided whether users see own certs, team certs all all of them
  • Database is now installed as a service

Fixes

  • Logout would log out all sessions from the same IP
  • Key retention could not be set to zero

Version 1.1.0

Release Date: 15thFebruary 2021

Updates:

  • Support for PrimeKey’s EJBCA Added
  • Private Keys can now be stored for a configurable length of time
  • There is now the ability to download a certificate in JKS and PEM formats, as well as PKCS#12
  • Emails can now include a link to the certificate
  • Extra information can now be stored with a certificate
  • Additional emails can be set for a certificate so that those recipients are also emailed regarding issuance and expiry
  • Certificate search improvements. More options available and searches can be stored and retrieved
  • Teams are now supported. Users can be added to many teams. New Certificate Issuers can be automatically added to specific teams
  • There are now two types of credential - username and password or just password

Fixes:

  • CSR is now accepted even if it does not contain the correct PEM headers
  • Corrected a bug in the email sending logic

Version 1.0.0

Release Date: 22 January 2021

Updates: Initial Release