Release Notes On-prem - Patch 1

Centralized Access Control in Platform Settings, providing a single location to manage tenant-level onboarding group ACL enforcement and Dashboard ACL configuration. Existing behavior remains unchanged unless the new settings are enabled.

Added support to override the path length constraint during subordinate CA certificate issuance, enabling successful issuance of externally generated CSRs without a predefined path length.

Resolved an issue where the HAProxy device management process failed during the download configuration file phase.

Resolved an issue where certificates enrolled through the SCEP Microsoft Intune connector were not delivered to client devices, ensuring successful end-to-end certificate enrollment.

Resolved an issue that prevented automated DNS validation for wildcard ACME certificate enrollment with Infoblox, enabling successful certificate issuance.

Resolved an issue where unrelated DNS TXT records could be removed during domain control validation, ensuring only the validation-specific record is deleted.

Resolved an issue that allowed scheduled discovery to run for devices in Unmanaged status. Discovery execution now verifies device status and prevents execution by failing the affected batch when the device is unmanaged.

Resolved an issue where the mTLS status was incorrectly displayed as always enabled during network scan discovery under the Scan Status tab.

Resolved an issue in Sectigo discovery with multiple organizations where the final organization was incorrectly applied to all certificates, leading to mismatches during enrollment.

Resolved an issue where additional cipher strength data (key type and strength) caused ciphers to be categorized under the Unknown list.

Resolved duplicate job executions caused by a Java wait condition at the pod level.

Enhanced GlobalSign MSSL enrollment to support subdomain-based creation, with costing aligned to the CA’s subdomain pricing model.

Resolved an issue where certificate auto re-enrollment through the Policy Engine was not functioning for the Scheduler role.

Upgraded Kubernetes and multiple infrastructure components to address known security vulnerabilities as part of the security patch. These upgrades improve the security, stability, and reliability of both On-Premises and SaaS deployments across supported Kubernetes platforms.

Addressed SAST and SCA security vulnerabilities identified in the Infrastructure Upgrade module by applying the latest available security patches to underlying operating system.

Resolved an issue where access to the HSM Master Key intermittently failed. Updating the HSM restored normal functionality.

Resolved documentation issues in the Swagger specification and API documentation for the Infrastructure Group Host Listing API and the Key Provision API. The API documentation was updated to accurately reflect the correct request parameters, response structures, and behavior for both endpoints.

Resolved an issue in the SSH Key and Certificate provision workflow where the Valid From and Valid To date values configured during the Key and Certificate Configuration step were not editable in the Review and Confirm screen. The provision action was updated to display the configured date values as editable fields during the Review and Confirm stage, allowing users to modify them before final confirmation.

Resolved an issue where a credential fetch failure on a single host would halt provisioning for the entire batch. Failed hosts are now individually flagged, allowing provisioning to continue uninterrupted for all other valid hosts.

The Fetch F5 Master Key workflow fails when backup information is unavailable, preventing retrieval and storage of the master key from managed F5 devices.