Release Notes SaaS Patch 1

New Features

There are no new features in software in this release.

CERT

Added support for full AWS IAM role paths (for example, /dept/env/role-name) across AWS integration workflows, including Cloud Account Onboarding, AWS Private CA integration, and AWS-hosted Server Onboarding. Validation is enhanced to support both simple role names and hierarchical paths, improving compatibility with complex IAM structures.
Enhanced the CSR upload feature to support both <.PEM> and <.TXT> file formats, providing greater flexibility in certificate submission.

Platform

Added support for executing Ansible playbooks on SaaS instances via the Ansible Executor task available in Automation Workflows. YAML files are securely transferred from pods to CC for execution. Execution logs are captured and made available for troubleshooting and audit purposes.

CERT

In DigiCert certificate discovery, both the certificate status and the order status are considered to determine the revocation state of each certificate
The certificate push failure alert will now be triggered only for the specific vendor where the failure occurred, instead of generating alerts for all configured vendors.
The issue where certificate push operations were getting stuck in the pre‑push stage due to missing workorder details has been resolved by implementing a controlled retry mechanism.

Platform

Resolved an issue where CC status change alerts were not generated on the Alerts page when triggered by back-end health pulse updates. Earlier, alert generation required a valid user session, leading to failures when no user was logged in. With this fix, status change alerts are reliably generated and displayed on the Alerts page, even without an active UI session.

PKI

Resolved an issue where MTLS authentication failed and the certificate chain was not displayed in Holistic View when the leaf certificate had unlimited validity (for example, expiry 31-12-9999 23:59:59). A configurable flag now allows certificate chain formation and MTLS authentication to proceed without enforcing the standard validity check for such certificates.
Fixed an issue in PKIaaS Native CA end-entity (leaf) certificates where revoked certificates could incorrectly appear as Valid during on-demand OCSP revocation checks from the CERT+ module prior to CRL publication.
Enhanced Key Usage handling to ensure standards-compliant certificate issuance for non-RSA algorithms by automatically removing unsupported key usages. Introduced a configurable template option to enforce strict Key Usage validation while preserving compatibility with existing workflows. Additionally, existing RSA-based OCSP signing certificates can be used with EC-based CAs as well.

There are no known issues in software in this release.

There are no limitations in software in this release.