Skip to main content

1.6.2

Released 22 October 2026

Changed behaviour​

  • A revocation also revokes a certificate the CA issued but CertAutoPilot could not store. It is revoked before the certificate in use, and the revocation only reports success once the CA has revoked both.

  • Cancelling a running re-issue from the Jobs page is not recorded as a failure. The certificate returns to its previous status without a Last Error, a "Last re-issue failed" banner or an Issuance failed notification, and the cancel is shown on the timeline.

  • On the automatic DNS-01 flow, a re-issue cancelled after the CA issued the new certificate keeps that certificate for two hours. A Re-issue within that time stores it without a new order at the CA; after it, the certificate is discarded and the certificate in use keeps its own key.

  • A worker that stops or loses its job no longer cancels the issuance it was running. The job runs again and continues where it stopped; only a cancel from the Jobs page or the API cancels it.

  • A cancel from the Jobs page always ends a running job. A job the cancel interrupted mid-step used to be retried, and was cancelled again on every attempt.

  • Creating an account on a custom ACME CA fails when the CA cannot be read back afterwards. Nothing is kept and the error asks you to try again, with a new External Account Binding key if the CA does not accept the used one.

Multi-node installs

Until every node runs 1.6.2, a revocation picked up by an older worker does not revoke a certificate the CA issued but CertAutoPilot could not store, and fails instead of waiting when another job holds the certificate.

Fixed​

  • Revoke works right after a certificate turns Active. For a few seconds after an issuance or renewal, a revocation was refused as "an issuance is running"; it is now queued and runs once that job finishes.

  • A revocation that finds the certificate busy waits and tries again. It used to fail after a few quick attempts when another job held the certificate.

  • The DNS-01 challenge records of an abandoned issuance are removed. When an issuance's state expired and a later job replaced it, its TXT records were left in the zone.

  • Cancelling an issuance that is waiting in the queue after the CA issued the certificate keeps that certificate usable. The key it needs used to be replaced, so the next Re-issue placed a new order.

  • An AD CS renewal the CA refused is no longer sent again after a database error. A failed status write used to drop the refusal mark, and the certificate could also be left in Renewal Pending with automatic renewal stopped; it now goes to Renewal Failed.

  • An AD CS re-issue started from Renewal Failed that stopped before it contacted the CA returns to Renewal Failed. It used to come back Active with automatic renewal silently stopped.

  • AD CS answers that only contain "error" or "fail" inside another word are no longer read as a failure. A status code such as ERROR_SUCCESS or a word such as "failover" used to end the request; a denial that also says it failed now stops the renewal like any other denial.

  • A first issuance cancelled while its propagation check or finalize ran shows why it is pending. It used to look like a certificate created a moment ago.