Skip to main content

1.5.42

Released 15 August 2026

Approval grows past the certificate. Until now the four-eyes gate covered issuing, renewing and revoking. It now also covers the deployment side: who may change a target, a script library or a variable, and who may push a certificate to production. Alongside that, discovery becomes something you can schedule and bound, deleting a project can no longer quietly orphan your encrypted credentials, and a certificate issued by an internal CA can finally be revoked.

New​

  • Approval for configuration changes — Creating, editing or deleting a distribution target, a target group and its members, a PathSet, an ActionSet, a project variable or a module configuration can now require admin approval. This ships enabled; read Changed behaviour below, because it also changes who may make those changes at all.
  • Approval for distribution actions — Optionally require approval before an operator links a certificate to a target, changes a distribution's settings, unlinks it, runs it or rolls it back. Off by default; enable it in Settings → General.
  • See exactly what you are approving — A configuration or distribution request now shows a Proposed change panel, so the reviewer reads the actual new values instead of approving a name. Secret variable values stay encrypted and are never displayed.
  • Scheduled discovery scans — A source can now run on selected weekdays at a fixed time in a timezone you choose, instead of only "every N hours" — ideal for keeping wide network sweeps inside a night-time window.
  • Scan time limit — Each network source carries a wall-clock budget for the whole scan (default 30 minutes, adjustable from 1 to 240 in the source form and later on the source detail page), so a sweep stops cleanly instead of running unbounded.

Improved​

  • Scan results appear while the scan is still running — Discovered endpoints and certificates are saved as they are found, so the inventory fills in progressively during a long sweep. Previously nothing was written until the whole scan finished.
  • A cancelled scan keeps what it found — Stopping a scan, or restarting during one, no longer discards the endpoints already discovered in that run.
  • Findings stop flapping mid-scan — A finding based on cipher-suite results no longer briefly resolved and reopened while a scan was in progress. Cipher verdicts are held steady during the crawl and reconciled in one pass afterwards.
  • A stuck scan un-sticks itself — A source left marked "scanning" by a crashed run is now cleared by an hourly check. Before, that source could never be scanned again without manual intervention.
  • Failures explain themselves — When a background job fails unexpectedly, its log records a diagnostic trace, so a support case starts with evidence instead of a guess.
  • Correct roles in the in-app API reference — Every endpoint now lists the minimum role that genuinely applies — including the ones whose required role changed in this release — and the reference explains the response you get when an approval gate is active.

Changed behaviour​

Read this before upgrading

The first two items change what your operators can do and what an automated client receives back.

  • Operators can now edit the deployment configuration — behind approval. Targets, target groups, PathSets, ActionSets, project variables and module configurations used to be admin-only. Operators may now change them, but each change is held for admin approval, because the configuration-change gate ships enabled. Switching that gate off (owner only) gives operators direct, unreviewed access to those objects — do it deliberately. Module credentials remain admin-only either way.
  • A gated write answers "approval requested", not the object. When a gate applies, the request is accepted and an approval record is returned instead of the created or updated resource, and nothing changes until it is approved and executed. The web UI shows this plainly; automation that reads an identifier out of the response must handle it too, or run as an admin, who bypasses both gates.
  • Only an owner can change the two new approval settings. Admins can approve requests but cannot turn the gates themselves on or off.
  • Automatic deployments are never gated. Only the manual, operator-initiated action waits for approval. The scheduler's automatic post-renewal distribution runs as before — gating it would block renewals.
  • A project cannot be deleted while it still contains anything. Deletion is refused while the project still holds certificates, zones, ACME accounts, DNS credentials, AD CS connections, targets, target groups, module configurations, module credentials, PathSets, ActionSets, project variables, tracked domains, notification channels or rules, discovery sources, or a certificate policy — seventeen kinds of object, and the response lists what is blocking. This is deliberate: several of them hold envelope-encrypted secrets that used to survive the project as rows no screen could ever reach again.
  • Deleting a project now cleans up after itself. The project's role grants and discovery findings are removed with it instead of lingering.
  • Scans are time-bounded. Every network scan gets the 30-minute default budget unless you raise it. A scan that hits the limit is marked partial — and, importantly, endpoints it never reached are not marked as disappeared, so nothing is falsely removed from your inventory. If you sweep a large range with deep SNI discovery, raise the limit on that source before its next scheduled run.
  • When the approval setting cannot be read, approval is required. If the settings record is briefly unreadable, gated operations now ask for approval rather than silently proceeding as though every gate were off.
  • Manual "Scan now" is rate-limited to ten requests per minute per project.

Fixed​

  • Certificates from a self-hosted CA could be issued but never revoked. With an internal ACME CA on a private address, issuance worked while revocation, renewal-window refresh, account validation and the final step of a slow-DNS issuance were all refused by the outbound network policy — so a compromised certificate could not be revoked through the product. They now use the same policy as issuance. Registering a new account against an internal CA remains restricted on purpose.
  • One project's resource names could be read from another project. The pre-check that explains why a delete is blocked accepted any project identifier, so a member of one project could learn the names and counts of another project's ACME accounts, DNS credentials, AD CS connections, script libraries, variables and tracked domains. It is now confined to the project you are working in.
  • Deleting a discovery source during its own scan left rows behind. The running scan kept writing results for a source that no longer existed, leaving inventory rows no page could show and no cleanup would reclaim. Those results are now discarded and reclaimed.
  • Approval e-mails for configuration and distribution requests arrived blank. Subject and body ended with nothing where the resource name belongs, because the template only knew how to name a certificate. They now name the resource.
  • Simultaneous approval requests could go unannounced. When two were raised at nearly the same moment only the first produced a notification; each request now notifies independently.