Skip to main content

1.5.57

Released 13 October 2026

New​

  • A redesigned interface. Navigation moves to a left sidebar with grouped sections, the project switcher and the approvals badge; ⌘K (Ctrl K) jumps to any page, certificate or target, and the header shows the project's healthy, expiring and failed certificates as links. The dashboard opens with a renewal runway — every certificate expiring in the next 90 days on the day it ends — and groups repeated job failures into one line with a count.
  • The certificate page shows its lifetime and its chain of trust. A timeline from issue to expiry with the renewal window marked, every name the certificate serves, its versions, and the chain from the trusted root down to the certificate — each link with its key, signature and lifetime on a shared time axis, and a warning when a CA ends before the certificate it signs.
  • Download an intermediate or root CA certificate on its own. Each CA in a certificate's chain of trust has its own PEM download.
  • Kubernetes: find the Secrets by certificate names. A Kubernetes target (or one distribution's override row) can update every TLS Secret in the chosen namespaces that already serves the certificate's names, instead of a hand-typed list — in place, keeping each Secret's own labels, annotations and owners. Secrets that would lose a name, belong to another certificate, are immutable or are managed by cert-manager or Helm are left alone and shown with the reason; nothing is created or deleted.
  • Kubernetes rollouts follow the Secrets. Every Deployment, StatefulSet and DaemonSet that uses an updated Secret is rolled out by default, only when its Secret actually changed (a rollout a run could not finish is done by the next run); the operator can narrow it by namespace, kind or label selector, remove single workloads, pick only listed ones, or turn it off. Preview the Secrets and rollouts in the target form and the override drawer, and the dry run, show exactly which Secrets will change and which workloads will roll out before anything runs.
warning
Multi-node installs: upgrade every node before using Find by certificate names

A node still on 1.5.56 does not know the new setting. While it runs a deployment for such a target it writes the automatic cap-<token>-<domain> Secret instead, and saving the target through it drops the setting. Switch a target to Find by certificate names only after every node runs 1.5.57.

Improved​

  • Discovery pages read by name. The inventory, a source's page and a discovered certificate show the certificate's name and organisation instead of the raw subject, with how long it has left; the discovered certificate's page shows the chain the server sent and its names without cutting them off.
  • IIS single-binding pickers only offer bindings that exist. In a target or a per-distribution override, choosing a host header narrows the port list to the ports it is bound on and choosing a port narrows the host-header list, so a host that lives only on 443 can no longer be paired with 8443 from the lists. When the fields name no binding, or several (no host header on a shared port), a warning under them says so — with what the site has on that port — before a preview or a deploy is refused.

Fixed​

  • Huawei Cloud no longer shows “Invalid value” on certificates CertAutoPilot deployed. ELB, CDN and WAF certificates from an ACME CA were uploaded with a blank line between the certificates of the chain; the API accepted it, but the console's Modify Certificate form rejected the stored content. The chain is now sent without blank lines, and certificates deployed earlier are rewritten once on their next run.
  • The standalone installer no longer installs a MongoDB that crashes on Linux 6.19 – 7.0.13. On those kernels (Ubuntu 26.04's first kernel among them) MongoDB 8.2 started and crashed within minutes; the installer now stops before installing anything and says how to fix it — upgrade the kernel to 7.0.14 or later, boot an older one, or use an external MongoDB. The kernel is now judged by its real upstream version, so Ubuntu's 7.0.0-<n> numbering no longer hides it.
  • The first change after an idle session no longer fails with “CSRF token mismatch”. When the session's short-lived sign-in had expired, the request that renewed it was re-sent with a malformed security header and refused; saving, running or previewing worked only on the second click.