Skip to main content

1.5.37

Released 7 August 2026

History you can actually use. Every renewal already produced a new certificate; from this release each one is kept as a labelled, downloadable version with its own private key, with automatic pruning so storage stays bounded. Audit forwarding also becomes SIEM-native, and discovery learns to warn about expired root CAs.

New​

  • Download any past certificate version — The Certificates tab lists each version with its serial number, expiry and issue date, and gives every row its own download button. The private key that belongs to that version is served with it, so an exported older version is always self-consistent.
  • History retention setting — Settings → General gains a History Versions field controlling how many versions to keep per certificate: 10 by default, up to 100, or unlimited. Older versions — and any private key no longer needed by a retained one — are removed automatically when a renewal creates a new version.
  • Tell versions apart at a glance — Each stored version now records its serial number, expiry and fingerprint, instead of being distinguishable only by creation date.
  • CEF and LEEF syslog formats — Settings → Syslog gains a format selector: RFC 5424 (default), CEF for ArcSight and Splunk, or LEEF for IBM QRadar. With CEF or LEEF your SIEM parses CertAutoPilot audit events natively, with severity mapped from the outcome.
  • Expired root CA flagged in discovery — Discovery records the expiry of the top-most CA a server presents and raises a new risk factor when it has already passed, so legacy chains still serving an out-of-date root become visible.

Improved​

  • Richer audit data in the new formats — Forwarded events also carry the actor's IP address, the project, and the CertAutoPilot version, using the field names each SIEM expects.
  • The syslog test matches your chosen format, so you see exactly the shape your SIEM will have to parse.
  • Existing certificates get their history filled in — Serial number and expiry are backfilled for versions stored before this release, so the history view is populated for older certificates.
  • Faster certificate detail page — The page no longer transfers the full certificate text for every historical version, so certificates with long histories load noticeably quicker.
  • Longer visible history — Up to 100 versions are listed, rather than 20.

Changed behaviour​

Old certificate versions are now pruned

Previously every renewal's certificate was kept indefinitely. From this release only the newest 10 versions per certificate are retained by default; older ones, and their unreferenced private keys, are deleted when the next renewal happens. If you rely on a longer archive, raise the limit — or set it to unlimited — in Settings → General before your next renewal cycle.

  • Approval-gated downloads stay on the current version. With "require approval for download" enabled, an approved download always returns the current certificate. Downloading a specific past version is available on the direct path only — to admin and owner users, or when download approval is off.
  • An invalid syslog format is rejected. Saving or testing with a format other than the three supported ones now returns an error; if an unrecognised value is already stored, forwarding falls back to RFC 5424 and logs a warning.
  • Discovery risk scores can shift. A chain presenting an expired CA now contributes to the score — at a moderate weight, so it does not reach "high" on its own — which may change the risk level of already-discovered certificates after their next scan.

Fixed​

  • Long audit values no longer produce malformed syslog output. A truncated action or resource identifier could be cut in the middle of a multi-byte character, and a value containing a newline or null byte could split or silently shorten the message at a strict receiver. Values are now cut on character boundaries and those control characters are folded to spaces.