Documentation | CertSecure

v3.3.0 Release Notes

Release date: 3 July 2026

New Features

The v3.3.0 release of Encryption Consulting CertSecure Manager adds the following features:

Certificate Authority Integrations

Sectigo Certificate Manager (SCM) Integration: Onboard Sectigo SCM as a CA and manage the full SSL certificate lifecycle (enrollment, collection, approval/decline, replacement, and revocation) from CertSecure. Includes domain and organization management, automated and manual CNAME/HTTP/HTTPS/email Domain Control Validation (DCV), inventory sync, and SSL reporting.
GlobalSign Atlas (HVCA) Integration: New connector for issuing, revoking, and synchronizing certificates from GlobalSign's Atlas High Volume CA over its REST/mTLS API, with inventory sync that preserves user-edited fields across re-syncs.
AWS Private CA Integration: Onboard AWS Private Certificate Authority for certificate issuance, including CA metadata/policy retrieval, PKI chain-health information, and a dedicated AWS PCA certificate template with extended-key-usage mapping.
HashiCorp Vault Certificate Lifecycle Management: End-to-end Vault PKI management: configure a Vault PKI mount, list roles, generate / renew / revoke certificates, and ingest/sync issued certificates into inventory with sync-status and job tracking, plus certificate ownership transfer.
Agentless CA Onboarding: Enhanced agentless connector onboarding for common CA modules, with self-registration, bootstrap-retry, and onboarding-validation improvements.

Certificate Renewal

Renewal Manager: New agentless renewal service that manages certificate renewal across remote IIS, Apache, Nginx, and Tomcat servers. Adds server/endpoint registration, credential storage, automation on/off controls, scheduled and manual renewals, task tracking, and audit logging via a full /renewalManager API, with a downloadable Renewal Manager package.
Scheduled Certificate Renewals: Renewal tasks can be scheduled for a future time; a background job runs scheduled renewals when due and skips agents that are offline.

Certificate Discovery

HashiCorp Vault Certificate Discovery: New Vault discovery scan type with /vault_config CRUD endpoints to scan Vault PKI mounts and import discovered certificates into inventory (with FQDN resolution for host fields).
Watcher Group Ownership for Discovered Certificates: Assign watcher groups (not just a single owner) to discovered certificates via /ownership/group and bulk endpoints. Owner and watcher-group assignment are mutually exclusive, expiry alerts are emailed to every member of an assigned watcher group, and inventory/analytics responses return watcher group names alongside IDs.
Discovered Certificate Ownership & Expiry Alerts: Discovered certificates can be assigned a validated owner (restricted to the Manage Discovery permission). Owners receive 30-day expiry email alerts with a CSV of their expiring certificates (deduped daily, skips weekends).
Bulk URL Upload for Network Discovery: Add many target URLs at once via CSV upload (with a downloadable sample template) instead of entering them one at a time, with per-row validation. Each URL carries its own port choice (Standard / All / Custom), the Ports column accepts an ALL keyword, and limits were raised to 20,000 rows / 20 MB.
Bulk Host CSV Upload for Linux/Container Discovery: Add many SSH hosts at once via CSV upload (Host, Port, UserName, Password) with a downloadable sample template and per-row validation (Host/Password required, Port defaults to 22, UserName defaults to root, capped at 1,000 rows).
Paginated, Filterable Discovery Inventory: New paginated /inventory/list endpoint plus filter-dropdown endpoints to page through and filter discovered certificates by scan name, certificate category, scan type, owner, key algorithm/size, and free-text keyword.
Custom Linux Trust-Store Scan Paths: Linux store and container scans accept a custom list of trust-store file paths instead of only the built-in defaults.
Automatic Host Discovery Toggle (Linux store/container): A new Discover Hosts option lets the agent discover linux target hosts based on AWS Tags, instead of requiring an explicit host list; the two modes are mutually exclusive. Linux scan determine hosts dynamically (ephemeral hosts) similar to windows host.

Inventory

Multi-Criteria Inventory Filtering: The Inventory list supports filtering on many fields simultaneously: Common Name, Organization, OU, Country, State, City, Owner, signing/public-key algorithm, key usages, EKU, watchers, tags, status, and date ranges. Filters combine (AND across fields, OR within a field), with field-metadata driving the UI controls. The discovery inventory list gained the same per-field filtering.

Enrollment and Certificate Download

Private Key Included in Certificate Download: A "Download with private key" option exports an enrolled certificate together with its private key as a password-protected ZIP, with the password validated against the configured password policy.
Override or Merge CSR SANs at Enrollment: CSR-based enrollment exposes an override_csr_sans flag and explicit san_attributes: SANs from the submitted CSR are merged with requested SANs by default, or fully overridden, for precise control over the certificate's Subject Alternative Names.
ACME CSR-Based Enrollment: ACME CAs (Let's Encrypt, Google Public CA) can be enrolled via a customer-supplied CSR. All DNS names in the CSR (CN + SAN) are validated against a single registered ACME parent domain, with clear errors for unsupported identifier types, wildcard handling, and cross-domain SAN mismatches. ACME renewals are also supported through the Renewal Agent.
AWS Public CA Certificate Private-Key / PFX Export: Export option for AWS-issued certificates so the private key can be exported and delivered (e.g. PFX export) when a certificate's configuration enables it.

Authentication and Licensing

Keycloak SSO Authentication: Integrated a full Keycloak/OIDC authentication framework with multi-realm support, role-based access control, single sign-on, and session management for the CertSecure Manager SaaS web application.
License Activation Route: New route to enter and activate a license, with improved error handling and user-information retrieval during activation.

Enhancements and Bug Fixes

The v3.3.0 release of Encryption Consulting CertSecure Manager fixes the following bugs:

Alerts

Third-party CA (TPCA) expiry alerts reworked: email and Microsoft Teams alerts separated, and expiry-reminder timing (7/30/60/90-day, daily/weekly cadence) made more reliable.

Discovery

Certificate type (Onboarded PKI vs Third Party) now classified against the CA's Issuer field for accurate attribution.

Reports

Risk reports now include expired and revoked certificates and accept case-variant UI inputs (e.g. Revoked/revoked).

Users

Hardened ownership transfer: enforced same-department matching (with global-admin override), corrected the user-type field used in validation, prevented duplicate roles in role listings, and made AD-group sync degrade gracefully when the AD Groups document is missing.

API Docs

Swagger/API documentation corrected to reflect new 4xx response codes and to remove deprecated sections.

On this Page: