Skip to main content

1.6.1

Released 21 October 2026

New​

  • Import from the files you have. The import page now takes a PFX / P12 file with its password, a certificate file in DER (.cer, .der) or PKCS#7 (.p7b) form, or pasted PEM as before. Both modern and legacy (3DES / RC2) PFX files are read, and the passwords are used once and never stored.

  • Passphrase-protected private keys can be imported. Enter the key's passphrase on the import page; CertAutoPilot decrypts the key once and stores it like any other key.

  • New Path Set file types. A Path Set can now write a Java KeyStore (.jks), a PKCS#7 chain bundle (.p7b, PEM or DER) or a passphrase-protected private key, with passwords taken from secret variables. They work for both SSH (Linux) and WinRM (Windows) targets.

  • Custom ACME CAs. Add an ACME server outside the public catalog, such as an internal step-ca, EJBCA or Vault PKI, under Certificate Authorities → Custom ACME CAs and use it like a public CA. Each one has its own trusted CA certificate, private-network rule and External Account Binding setting, and Test checks its directory.

  • Infoblox NIOS DNS provider. Certificates can be validated through an Infoblox Grid: CertAutoPilot writes the DNS-01 records over the Grid's API, in the DNS view you choose, with an API-only user. A private or self-signed Grid Manager certificate can be trusted by pasting it.

Multi-node installs: upgrade every node before using the new Path Set file types, custom ACME CAs or re-issue of a valid certificate

A Path Set that uses a Java KeyStore, a PKCS#7 bundle or a passphrase-protected private key can only be saved once every node runs 1.6.1 — until then saving it is refused. An older worker would not write these files correctly. The same applies to adding a custom ACME CA or an account on one: an older worker would not use the CA's certificate and network rule. A re-issue of a valid certificate picked up by an older worker still finishes without issuing anything — re-issue again once every node runs 1.6.1.

Until every node runs 1.6.1, an older node also lacks the other protections of this release: an older worker cannot use an Infoblox DNS credential, an older API node accepts a revoke while a re-issue or renewal is queued, and an older scheduler sends a renewal that AD CS refused again every 24 hours.

Downgrading from 1.6.1

Remove custom ACME CAs, their accounts and the new Path Set file types before going back to 1.6.0. An older version cannot use custom-CA accounts, and it writes a Path Set's passphrase-protected private key without the passphrase, as a plain key.

Changed behaviour​

  • A certificate whose renewal is waiting or has failed can be revoked. It still holds its certificate, so Revoke is offered and a queued renewal is cancelled; before, the revocation waited for a renewal that the pending revocation itself held back.

  • Cancelling a re-issue is no longer recorded as an error. The certificate returns to its previous status without a Last Error or a failure banner; the cancel stays on the timeline and in the audit log.

  • Revoking a certificate stops its queued issuance and renewal. A re-issue or renewal waiting in the queue is cancelled, and while one is running the revoke is refused until it finishes; Re-issue and Renew are refused while a revocation is pending.

  • An AD CS renewal the CA refuses is not sent again. The certificate goes to Renewal Failed and automatic renewal stops until you fix the cause at the CA and click Renew; the certificate page says so.

  • A Java KeyStore password must use Latin-1 characters. Letters such as ç, ö and ü work; ş, ğ, ı and İ cannot be stored the way Java reads them, so such a password is refused on download and fails the Path Set deployment with that reason.

  • A manual-DNS re-issue that is never validated is closed after two hours. The certificate returns to its previous status with its current key and the operator is notified; a pending re-issue can also be cancelled from the DNS Challenges card.

  • Re-issue is refused while a renewal of the certificate is running. Wait for the renewal or cancel its job first; before, both ran on the same order and one of them silently lost.

  • An encrypted private key is no longer refused on import. Without its passphrase the import asks for it, and a passphrase sent for a key that is not encrypted is refused.

  • A .jks file and an encrypted private key are rewritten on every distribution, like a .pfx, so the Action Set bound to the Path Set runs every time. A .p7b file is skipped when the certificate has not changed.

Fixed​

  • Re-issuing a valid certificate now issues a new certificate. It used to be accepted and do nothing, so a manual-DNS certificate, which cannot use Renew, could not be refreshed before it expired.

  • A revoked certificate can no longer come back. A re-issue queued or waiting to retry when the certificate was revoked used to run anyway and issue it again; such jobs now do nothing, and Retry on the Jobs page refuses them.

  • AD CS requests that need a CA manager's approval are now collected once approved. The status check sent to the enrollment service was refused by Windows on every attempt, and a request parked as Taken Under Submission was read as an error.

  • A request the CA refuses outright (Denied by Policy Module) fails once, for issuance and renewal alike. It used to be retried — up to three requests, three keys and three notifications, or five on the renewal ladder.

  • AD CS answers in other languages are understood. A returned certificate is an issuance and a request number without a certificate is a waiting request, whatever language the CA answers in.

  • A re-issue or renewal continued by another worker no longer enrols or orders a second time. The "already done" check compared the certificate's start date, which CAs backdate, with the job's start; it now looks at when the certificate was stored.

  • A re-issue of a certificate whose last renewal failed starts its own request. It used to continue the failed renewal's leftover request without a new key, and an AD CS denial then left the certificate stuck in Pending.

  • An AD CS re-issue stuck in Issuing is recovered. After two hours the certificate returns to the status it had, with its own key, and the operator is notified; before, it stayed in Issuing for good.

  • Every abandoned re-issue gives back the current certificate's key. Some recovery paths restored the status but left the new, unused key current, which a distribution could pair with the old certificate.

  • A manual-DNS re-issue's validation is audited when the certificate is stored, with a Certificate issued event on the timeline. Before, the audit entry was written when the TXT records were generated.

  • Expiry warnings keep coming while a re-issue or renewal waits — for a manual-DNS re-issue and for an AD CS request awaiting approval alike.

  • Cancelling a queued re-issue cleans up after it. The current certificate's key becomes current again and the TXT records the re-issue created are removed.

  • A re-issue keeps a certificate the previous attempt already received instead of ordering again, and a certificate that expired while its re-issue waited returns to Expired, not Active.

  • Re-issue requests that need approval are refused up front when they could never run, and two quick re-issue clicks share one job.

  • Retry on the Jobs page refuses a first-issuance job of a certificate that already holds one, and a retry a newer job already covers is answered with a conflict instead of a database error.

  • Renew is offered for expired certificates (the API always accepted it), and a key-rotating re-issue resets the rotation counter. The certificate list now offers Renew under the same rule as the certificate page, so it is no longer shown for manual-DNS certificates the API refuses.

  • The JKS download dialog checks the password before sending it and stays open when a download is refused, so the password can be corrected.

  • Renew and Re-issue are hidden while a revocation is in progress, with a line on the certificate page that says so.

  • Infoblox: a DNS cleanup with a missing view fails instead of passing. A view renamed or deleted between issuance and cleanup used to count as "already deleted" and leave the challenge record behind; a login page answering in place of the Grid is now reported as such.

  • Custom ACME CAs. Saving again after a failed copy now really updates the CA's accounts, a CA deleted or moved while an account registers no longer leaves a stray account, a pasted private key is refused, a rename to a taken name answers clearly, and a Test still running when the address changes no longer marks the new address as tested.

  • Java KeyStore passwords with ç, ö or ü now produce a keystore Java can open. Before, the deployment succeeded but Tomcat or keytool refused the file.

  • A .p7b file that repeats a certificate is accepted on import, like the same certificates pasted as PEM, and an unreadable DER certificate now says why.

  • A Path Set change approved during a rolling upgrade waits for the upgrade. Executing it is refused until every node runs 1.6.1 and can be retried then; an older worker would have written a passphrase-protected key unencrypted.