Skip to main content

1.5.56

Released 11 October 2026

New​

  • Fortinet FortiWeb distribution (18th module), without a dropped connection. On FortiWeb 8.0.7 and later the certificate is updated in place, so every policy, SNI member and multi-certificate entry that uses it gets the new version; on 8.0.5–8.0.6 each version is a new certificate moved into SNI members and multi-certificate entries, and a policy that uses the certificate in its own field is reported instead of changed. Nothing has to be picked: every place that already uses the certificate is followed and kept current, and the whole chain CertAutoPilot holds (the root too when it carries one) is served from the intermediate groups those places use — kept in chain order, without CA certificates a renewal left behind. A server policy is never modified unless the target explicitly allows it (Also update server policies, off by default — each such write drops that policy's connections). Appliances with administrative domains (ADOMs) are supported: each target names the ADOM it deploys in (empty means root), and an ADOM-scoped administrator account is enough.
  • FortiWeb pickers. The target form and the override drawer list the appliance's certificates, intermediate groups, SNI groups and members and multi-certificate entries (and mark groups and entries no server policy uses, which would serve the certificate to nobody), and Preview what a deploy would do shows — before saving — the firmware's method, what would be imported or moved, which policies stay on an old version and whether the deploy would be refused; earlier versions are deleted only when Delete previous version is on, and a wrong password is never retried: FortiWeb locks every administrator out from CertAutoPilot's address after repeated failed logins, so a run stops asking an appliance before its lockout threshold.

Improved​

  • Kerberos Windows targets are much faster with a remote or busy domain controller. IIS, WinRM, Exchange and Windows DNS over Kerberos now log in once per connection and reuse the ticket, instead of logging in to the domain controller for every request of a run (a single deploy made about 200 domain-controller round trips before, about 20 now).
  • The credential comes first on the target form. It now sits right under the target type, so every live picker below it can read the remote system as the form is filled from top to bottom.
  • Type lists are searchable. The credential, target, module and target-group type lists filter as you type.
  • Credential list filter. The credentials list can be filtered by credential type (up to 20 types at once), and the target, target-group and secret-store forms use it: their credential pickers list only the types the chosen module can use, so on a project with many credentials the right ones no longer hide behind the first page.
  • Add Targets to a group. The dialog lists only targets of the group's type and has a search box, so a target outside the first 50 can be found and added.

Changed behaviour​

  • Two-factor management is rate limited. Disabling two-factor authentication and regenerating recovery codes share one limit of 10 requests per minute per user; beyond it the request is refused with 429. Both calls require a current code, and the limit stops a session from guessing one.

Fixed​

  • Standalone install on RHEL 10. The installer picked MongoDB 7.0 on RHEL / Rocky / Alma / Oracle 10, whose MongoDB repository lacks the database tools the package needs, so the install stopped at the MongoDB step; it now installs MongoDB 8.0 there, as documented.
  • The Run confirmation closes. Confirming Run (or Unlink) on a distribution could leave the confirmation bubble on screen while the run was already going.
  • Confirmation and result dialogs follow dark mode. The target connection-test result and other pop-up confirmations were shown in the light theme while the rest of the app was dark.
  • The certificate page fits a phone screen. The top bar, the action buttons, the detail tables and the tab row no longer run off the right edge at phone width; wide tables scroll sideways instead.
  • A name typed into a picker is kept. Typing a value the remote system does not list (for example the name of a certificate object that does not exist yet) into a single-value picker and pressing Enter or leaving the field no longer empties it — the typed value is offered as the first option and kept, as the manual-entry button already did.
  • A new certificate version is no longer lost when the previous one is still deploying. When a renewal (or a re-import) enqueued a distribution run while the earlier run of the same distribution was still in progress, the new run failed at once on the busy lock, nothing re-queued it, and the targets kept the old version until the next renewal. The new run now completes as deferred and re-arms the distribution for the next distribution sweep, which pushes the new version once the earlier run has finished (rollbacks keep retrying as before).
  • Target edits no longer conflict with approvals after a deploy. Every deploy updated the target's Updated time while recording its per-certificate state, so a pending configuration-change request on that target was refused as stale as soon as any distribution ran. Only a real edit moves the time now.
  • A DNS record write is not repeated after a gateway error. When a DNS provider's gateway answered a record create with 502, 503 or 504, the write was sent again although the first one may already have been applied; a write is retried on a gateway error only when repeating it is safe (reads, replacements, deletes), and on 429 as before.
  • Pickers show names, not ids, on large projects. Editing a module configuration or a target whose saved target, target group, path set or action set was not among the first 50 listed showed the raw id; the saved item is fetched and shown by name.
  • Target-group form. The default-credential and initial-target pickers list only credentials and targets of the chosen type, and switching the type clears both picks instead of carrying over values the new type refuses.
  • My Requests. Approve and Reject are shown only in Pending Reviews and only to an admin of the current project — an admin role in some other project no longer opens an empty review tab with buttons that always failed — and a request raised in another project shows its certificate's name as text with a hint instead of a link to a page that could only say “not found”. The review badge in the user menu counts for a project-scoped admin too.
  • Quick Renew from the certificate list with renewal approval switched on reported “Renewal requested” although an approval request had been raised; it now says so and opens My Requests.
  • SAN deny-pattern preview matches the server. The issue wizard, the discovery “Manage” wizard and the policy page's test field treated a deny pattern such as *.internal.example.com as one label only, so a.b.internal.example.com previewed as allowed while the server refused it; the preview now covers the whole subtree, like the server, and ignores a trailing dot and letter case.
  • A naming pattern the browser cannot evaluate can be saved. The certificate-policy page rejected a valid Go pattern (for example one starting with (?i)) as “Invalid regex pattern” and would not save it; it now says the pattern cannot be tested in the browser and leaves the check to the server.
  • IIS override summary for “Target's sites”. A filtered selection that keeps the target's sites summarised itself with the target's whole placement, e.g. “cap-test-a · port 443 · any port”. It now names only the sites, “cap-test-a · any port”, because the selection's own IP, port and host-header filters replace the target's.
  • WinRM on plain HTTP: a bare “HTTP 500” now names its cause. A Windows target on port 5985 that refused requests because AllowUnencrypted was off reported only “HTTP 500”, which sent operators to the network; the message now says the host refuses unencrypted traffic and how to allow it (or to use HTTPS 5986). It is reported as an authentication failure and is no longer retried, like the 401 form of the same refusal (IIS, Windows and Exchange targets).
  • IIS override rows say when the Default row applies. An empty row on a single-binding target gave no sign that the Default row's placement was in force; it now says so, as rows on multi-site targets already did.