Skip to main content

1.5.38

Released 7 August 2026

Bring your own certificate. Not every certificate in an estate comes from an automated CA — there are vendor wildcards, offline enterprise CAs, partner-supplied certificates. From this release you can upload one and manage it in CertAutoPilot like any other: distribute it, download it, watch it expire, and refresh it by re-importing.

New​

  • Import an externally-issued certificate — An Import button beside Issue Certificate opens a page where you provide the certificate, any intermediates, and the matching private key, plus a name, owner and description. It becomes active immediately — no CA round-trip, no job — and is tagged Imported.
  • Re-import to refresh — Imported certificates get a Re-import action. Uploading a fresh certificate creates a new current version, keeps the previous one in history under your retention setting, and automatically re-triggers distribution to every linked target.
  • They behave like any other certificate — Imported certificates link to distribution targets, download in every format, and appear in expiry views, risk scoring, expiring-soon notifications and the certificate timeline exactly as issued ones do.
  • Imported filter and badge — The issuer filter in the certificate list offers Imported alongside your ACME and AD CS issuers, and imported rows carry a gold tag.

Improved​

  • Paste the blocks in any order — The leaf is identified by matching it against your private key, intermediates are re-ordered from the leaf upwards, and a self-signed root is automatically left out of the chain served to targets. The root's expiry is still recorded, so an expired-root warning still reaches you.
  • An honest detail page — For an imported certificate the renewal panel is replaced with one that explains re-import is the refresh path, and "next renewal" reads not applicable instead of showing a meaningless date.

Changed behaviour​

  • Import and re-import require the Admin role, not Operator. Import activates and distributes a certificate without passing through the approval workflow, so it is deliberately gated at Admin — otherwise an operator could use it to sidestep a "require approval for issuance" control.
  • Renew, reissue and revoke are rejected for imported certificates. Those buttons are hidden and the API explains why: there is no issuing CA behind an imported certificate. Use Re-import to refresh it, and delete it to retire it — revoking at the original CA, if that CA supports it.
  • Imported certificates never auto-renew. Auto-renew is forced off at import and cannot be turned on, and both the renewal sweeps and bulk renew skip them. They still flip to expired on time, still send expiring-soon notifications, and still count as non-automatable in the 47-day readiness score.
  • Certificate policy is not evaluated on import. Importing records an external fact rather than requesting issuance, so rules about key types, SAN patterns, naming and required auto-renew do not apply. A weak key is accepted and surfaces through risk scoring instead; the Admin-role requirement is the compensating control.
  • Stricter upload checks. An import is rejected with a clear reason if the private key does not match the certificate, the format is malformed, the key is passphrase-protected (decrypt it first), the certificate or an intermediate has already expired, or the upload contains an implausible number of certificate blocks. A leaf-only upload is accepted with a warning.
  • Re-import re-reads the certificate's identity. Domains, primary domain and key type are re-derived from the new certificate each time, so a refresh with different names or a different key algorithm stays accurate. If the domains change and an SSH or Windows distribution uses a domain variable inside its file path, the new file is written to the new path and the old one is left behind.

Fixed​

  • The certificate dependency graph no longer breaks for certificates with no issuer or no distributions; it returns proper, possibly empty, results instead of failing to render.