Release date: 2026-07-31
Release.txt
Detailed information about changed functionality, deprecated functions, corrected problems, and known issues is included in the Release.txt file. The file is provided with the installation media.
Overview of main new features
Soft token issuance via json-to-pkcs12 endpoint in REST API
New REST endpoints issue soft tokens containing the certificate and private key.
GET /certificates/json-to-pkcs12 returns the form schema describing available context entries. Use 'procid' query parameter to get a procedure-specific schema or the default if unspecified. The schema describes context entries for issuing a soft token.
POST /certificates/json-to-pkcs12 issues a PKCS#12 using provided context entries. The request body contains the required 'procid', optional 'password', and a 'certrequests' array with context entries. The contents of the certrequests array is validated against the schema configured in iv-schema-map.properties.
See swagger.yaml for details.
ListCertificates REST API performance improvement
The ListCertificates endpoint in the CM REST API now supports a new query parameter, "skipCount," allowing clients to bypass the certificate count query on each request, improving performance when the total count is unnecessary. This change is backward compatible; the default behavior remains unchanged (count and retrieve certificates).
Usage examples:
-
Count only (no certificate data):
skipCount=false&searchLimit=0 -
Retrieve only (no count):
skipCount=true&searchLimit=500 -
Count and retrieve (default behavior):
skipCount=false&searchLimit=500
Support for PKIMetal Certificate Linting in Certificate Factory
Certificate Factory integrates with the PKIMetal external linting service to validate certificates against industry standards at issuance. A new 'PKIMetalLinting' certificate format modifier connects to a configurable PKIMetal endpoint and can block issuance based on severity.
Configure linting profiles, severity thresholds, and per-code ignore lists in 'config/linter/pkimetal.conf'. See https://github.com/pkimetal/pkimetaland PKIMetal linting in Certificate Manager for details.
CM integration with PKCS#11 v3.2 for 'Pure' ML-DSA
Support for key-pair generation, digital signatures, and signature verification using 'Pure' ML-DSA algorithms through the PKCS#11 v3.2 interface.
Composite ML-DSA support
Certificate Manager now supports software-based Composite ML-DSA keys, signatures, and certificates.
The supported composite signature draft is draft-ietf-lamps-pq-composite-sigs-19.
Composite ML-DSA key generation in KAR
Server-side key generation is now supported for all 18 Composite ML-DSA variants when using Key Archival and Recovery (KAR).
Readiness and liveness endpoints documentation
The Technical Description document has been updated with details about the liveness and readiness endpoints for both Certificate Factory (CF) and Protocol Gateway.
Hybrid X.509 certificates and CRLs
CM supports issuing hybrid X.509 (CA and end user) certificates that include an alternative public key and carry both a primary and alternative signature, following Recommendation ITU-T X.509(10/19) | ISO/IEC 9594-8 (Chimera or Catalyst). CRLs issued by a hybrid CA also carry both primary and alternative signatures per the same recommendation.
Hybrid CAs can issue subordinate (including hybrid) CAs or end-user certificates with alternative signatures alongside primary signatures. The AWB supports creating, viewing, and exporting/importing hybrid CAs and procedures with alternative key configurations.
The following extensions are used in hybrid certificates:
-
id-ce-subjectAltPublicKeyInfo 2.5.29.72
-
id-ce-altSignatureAlgorithm 2.5.29.73
-
id-ce-altSignatureValue 2.5.29.74
The following extensions are used in hybrid CRLs:
-
id-ce-altSignatureAlgorithm 2.5.29.73
-
id-ce-altSignatureValue 2.5.29.74
For more information see Create Hybrid CA in Certificate Manager and Create Hybrid CRLs in Certificate Manager.
V2X: Support for TLS client certificate authentication
The C2X servlet in Protocol Gateway now supports TLS client certificate authentication as an alternative to OAuth/JWK access token authentication.
The authentication method can be configured per handler using the 'accesscontrol.method' property. Supported values are 'jwk-token' (default) and 'tls-client-cert'. When using TLS client certificates, a trust store with accepted issuer certificates must be configured. Both methods can coexist in the same deployment.
See c2x.properties for configuration details.
Changed functionality
CMDB installation default password updated
To account for stricter account password policies in MySQL and other databases, the default CMDB password has been updated to support installations using only default settings such as demo and test deployments.
rfc5280.conf updated to support hybrid end-user certificates
The AltSignatureAlgorithmModifier module has been added to the default rfc5280.conf certificate format. This enables the Certificate Factory to include alternative signature extensions (id-ce-altSignatureAlgorithm and id-ce-altSignatureValue) in end-user certificates issued by a hybrid CA.
Customers upgrading should add the AltSignatureAlgorithmModifier entry to their existing rfc5280.conf as described in the upgrade guide.
No action is required if not using hybrid CAs.
PGW hardening fix and servlet schema updated to 6.0
PGW Tomcat security hardening now restricts allowed HTTP methods on servlets. The servlet schema has been updated to the 6.0 Servlet Specification, supported by Tomcat 10.1.x.
Contact and support
For information regarding support, training, and other services in your area, visit https://nexus.ingroupe.com/. Nexus offers maintenance and support services for components to customers and partners.
For more information, go to Nexus Technical Support or contact your local sales representative.