Release Notes - Certify Management Agent

7.4.1 : 2026/11/05

Enhancements:

• Certificate requests: a custom CSR can now be used as a source for subject fields (such as Organization, Locality and Country), set from the hub. They are copied into the generated CSR, which keeps the certificate's own domains and private key
• DNS: the Propagation Delay Seconds option is available again for Azure DNS
• Stored credentials: credentials that cannot be decrypted are now reported when the service starts and during maintenance, as a warning in system status with the affected credentials in the service log, instead of only showing up later as failed renewals and deployments.

Fixes:

• Security: includes the .NET runtime update for Microsoft Security Advisory CVE-2026-111497 (.NET Brotli Decoder Out-of-bounds Write Vulnerability)
• Certificate subscriptions: when a source certificate cannot be downloaded through the hub, the reason is now shown, such as the source instance not being connected, not responding, or no longer having the certificate
• Deployment tasks: a task result with a warning is now reported as a warning instead of Task Completed OK
• Deployment tasks: a Restart a Service task no longer stops the service running the certificate request, which ended the request before it was recorded and caused it to run again on every start. The task skips the stop with a warning
• Managed challenges: a gateway error (502, 503 or 504) from the Management Hub is retried, and is reported as the hub not responding
• Settings: if the settings file cannot be read, the instance keeps its settings and instance id instead of saving defaults over the file. Settings are now saved by writing a new file and swapping it in
• Status reporting: a status report that cannot be sent is logged as a warning and retried once. Failed diagnostic checks are now reported even when no reporting email is set, up to 10 times per problem until the service restarts

7.4.0 : 2026/10/22

Enhancements:

• Certificate requests: new dns-account-01 challenge type (IETF draft), a variant of dns-01 whose TXT record name is specific to your ACME account, so several ACME clients or accounts can validate the same domain at the same time without overwriting each other's records
• Certificate requests: dns-persist-01 now supports the latest draft, including hashed account values, and builds records in the form the CA's directory asks for
• Certificate requests: before validation, dns-persist-01 records are now looked up and checked against what the CA will accept. A missing or unsuitable record is logged as a warning giving the record the CA would accept. The request still goes ahead, as the CA makes the final check
• Stored credentials: a secret field can now take its value from an API Key or Token stored credential
• Certificate requests: names a CA adds to the order that you did not request, such as the www show a warning in the request log. Enable the new Strict ACME Order Identifiers instance setting from the hub to leave them out

Fixes:

• Certificate subscriptions: scheduled subscription updates now run as tracked requests for progress and task reporting.
• Management Hub: changing the hub URL or joining the hub again now connects with the new details without restarting the service.
• Certificates: empty domain entries in a certificate saved through the API are now removed, so they no longer cause errors

7.3.1 : 2026/10/16

Enhancements:

• Management Hub: the hub admin can now restrict local changes on this agent to read only, or to deployment tasks only

Fixes:

• Certificate requests: the CSR now always includes the requested domains, even if the CA changes its order
• Certificate requests: finalizing no longer fails with an unexpected error when the CA does not return the order
• Certificate requests: a certificate can no longer be saved while a certificate request for it is in progress, as the request would overwrite the changes when it finishes. The hub shows why the save was refused
• Certificate requests: on Linux and macOS, failing to write the certificate to the .NET certificate store is now a warning instead of a failed request, as nothing else currently uses that store. Certificate storage errors now include the underlying cause
• Management Hub: saves from the hub no longer time out while the agent is busy with a long-running command such as a certificate request
• Management Hub: the hub's certificate list for this agent now stays current after certificates are imported, the data store is switched or the connection to the hub is restored
• Docker: the agent image now has a writable home folder for any user in the root group, such as on OpenShift, so the .NET certificate store can be written

7.3.0 : 2026/10/07

Enhancements:

• Management Hub: the agent now reports its certificate request runs and activity to the hub. Its renewals and any failures appear in the hub's activity and request history, with each request's stages and run log, so problems can be diagnosed from the hub without reading the agent's logs. Activity is held while the hub is unreachable and sent once it reconnects
• Management Hub: when the agent is removed from the hub, it now forgets its hub joining credentials, so it does not register itself again. Removal is now a single step on the hub.
• Deployment tasks: the Export Certificate and Tomcat tasks can optionally set a new password, held as a stored credential, for exported PFX files and encrypted PEM private keys.
• DNS: new EuroDNS (reseller) provider via Posh-ACME, for automated DNS validation of domains hosted there

Fixes:

• Certificate cleanup: certificate files still in use by a managed certificate are no longer removed for being over a year old. This affected certificate subscriptions, which update the same file in place
• DNS: Posh-ACME providers that need a separate save step now have their DNS record changes saved
• Challenge delegation: domain match rules can now match subdomains at any depth with **.domain.com
• Management Hub: notification email and CSR common name settings changed from the hub now persist on the agent

7.2.0 : 2026/08/27

Enhancements:

• Managed certificates: add an option to disable automatic failover to an alternative Certificate Authority, useful when using a Hub Managed ACME etc
• External certificate managers: improved config status reporting, log retrieval and on-demand refresh
• DNS: new providers available via Posh-ACME: DNSExit, GoDaddy DNS API v3, Hosting.nl, Infomaniak DNS API v2, Microsoft DNS, mijn.host and Spaceship
• DNS: AWS Route 53 now supports cross-account access using AssumeRole (contributed by VA6DAH)

Fixes:

• Manual DNS: paused orders correctly resume processing after the challenge has been completed
• Certificate cleanup: improve matching of certificate friendly names, including case-insensitive [Certify] markers and safer fallback names
• DNS providers: fix for following DMEasy insecure redirects
• Dashboard: fix persistence of dashboard registration state settings
• Package updates including BouncyCastle 2.7.0 and SSH.NET 2026.0.0

7.1.1 : 2026/07/09

• Fixes:
  • Core: important fix for failed renewals not being re-attempted due to deployment task success. All 7.x users are encouraged to upgrade.
  • PowerShell: errors raised in system powershell processes were not always flagged as a task failure, plus misc fixes and improvements

7.1.0 : 2026/07/01

General Release for 7.x

• Minor updates from previous release candidates.

7.0.22 : 2026-06-24

• Minor maintenance version update

7.0.21 : 2026-06-24

• Enhancements:
  • DNS: Added HostUp DNS provider support via Posh-ACME.
  • DNS: GoDaddy DNS now uses the Posh-ACME provider path, deprecating our legacy provider.
  • Scripts: Improved script execution providers, including updated Linux local script support and improved PowerShell result parameter handling.
  • Notifications: Added per-instance notification email preference support, used instead of ACME account email where configured.
• Fixes:
  • Licensing/Activation: Activation and licensing checks now use stable ID rather than machine name to avoid issues after hostname changes.
  • Subscriptions: Hub-sourced certificate subscriptions no longer poll unless renewal is due.
  • Deployment/Tasks: PowerShell in-process task execution now consistently supports optional result input parameter behavior.

7.0.20 : 2026-05-29

• Enhancements:
  • Core: Updated our draft dns-persists-01 suppport
• Fixes:
  • Tasks: Manually resolving a failed task now updates the overall status and reports to dashboard etc.
  • Tasks: Tasks should not execute if the previous request was a success, only the current primary request should be considered unless running tasks manually.
  • Core: Update ARI replace skip logic
  • Managed Challenges: prefer hub joined instance authentication before any other provided credentials

7.0.19 : 2026-05-22

• Enhancements:
  • PowerShell BREAKING CHANGE: PowerShell support has been significantly revised and compatibility may be affected. You are encouraged to test your workloads before deploying.
    • Previously 7.x versions used in-process PowerShell 7.x, which is not compatible with some existing PowerShell scripts/add-ins including our built-in example Exchange/RDP tasks. Versions before 7.x used an older version of .NET and In-Process PowerShell 5.1.
    • PowerShell scripts will now run in the default Automatic execution mode:
      • Windows: launches as a new process using the system PowerShell (5.1 by default where available).
      • Linux: runs PowerShell 7.x in-process
      • The Launch New Process option is retired in favour of the execution mode options.
      • Added experimental new Full Impersonation mode (Windows)
      • More information at https://docs.certifytheweb.com/docs/script-hooks
  • Core:
    • Common Name is now re-enabled by default in generated CSRs despite being deprecated, so there is now a global setting for this behaviour.
    • There is a new option to ensure CA intermediates are added to the machine intermediates store (Windows). Most machines do this automatically except where outgoing http is blocked.
    • Primary request status is now tracked independently of Task status for fine-grained error status tracking.
• Fixes:
  • Tasks: fix to allow a task to be manually run when the main request has failed, and also ensure tasks still run if they are set to run on primary request failure.
  • Various dependency updates, minor fixes and refinements

7.0.18 : 2026-04-10

• Enhancements:
  • Core: Implement support for Hub managed Certificate Subscriptions. This allows an authorized instance to subscribe to a hub managed certificate so that the hub can look after renewal and the managed instance just performs deployment.
  • Core: Draft support for the upcoming dns-persist-01 ACME Challenge type, which enabled persisent DNS validation with a single record per domain/subdomain.
  • Managed Challenges: Simplified config allowing default instance identify to be used instead of adding distinct API credentials. A new managed challenge polling mechanism also allows for long running managed challenge tasks.
  • DNS: Add Technitium provider via Posh-ACME

7.0.17 : 2026-02-12

• Enhancements:
  • Initial 7.x Production Release. No significant changes from 7.0.16.

7.0.16 : 2026-01-12

• Enhancements:
  • Core: Deprecate support for Days After/Days Before renewal internal modes. Shorter certificate lifetimes now require percentage lifetime elapsed based renewal.

7.0.15 : 2026-01-09

• Enhancements:

  • Core: New Maintenance Window feature allows you to optionally set a named day/time window in the week for renewals to be attempted, this can be applied globally per instance or per managed certificate.
  • Core & Export: New optional strict export chain building options and best-efforts chain building.

• Fixes:

  • Core: log when preferred chain not matched
  • CA: Some CAs require CN in the generated CSR

7.0.14 : 2025-11-21

• Fixes:
  • Core: IMPORTANT Fix issue with SQLite database filtering for auto renewed items. All 7.0.13 users must upgrade or renewals will not occur.
  • Hub: Fix issue with instance reconnection after hub restarts/updates failing due to expired authentication. This requires updating both the hub and any associated instances.

7.0.13 : 2025-11-17

• Enhancements:
  • Core: initial support for proxies via HTTPS_PROXY/HTTP_PROXY/CERTIFY_PROXY environment variables
  • Import/Export: updates for PFX destination path mapping.
  • DNS: New Hetzner Cloud provider via Posh-ACME
• Fixes:
  • Tasks: Apache/nginx files copy tasks updated for linux
  • Hub: Improved reconnection handling

7.0.12 : 2025-10-28

• Fixes:
  • DNS: Fix AWS Route 53 provider error due to SDK changes.

7.0.11 : 2025-10-24

• Enhancements:
  • General: Move from beta to release candidate status for production use.
  • Minor dependency updates
• Fixes:
  • CA: Google Trust Services currently require CN in the generated CSR
  • Core: Clean-up X509Certificate2 after use to avoid temp RSA keys remaining on disk.

7.0.10 : 2025-10-06

• Enhancements:
  • Minor dependency updates

7.0.9 : 2025-10-03

• Enhancements:
  • Minor dependency updates
• Fixes:
  • DNS: Fix incorrect parameter for NameSilo provider

7.0.8 : 2025-09-18

• Enhancements:
  • Minor dependency updates

7.0.7 : 2025-09-15

• Enhancements:
  • Minor dependency updates

7.0.6 : 2025-09-05

• Enhancements:
  • Core: Allow hub to manage instance licensing across multiple licenses
  • Core: Add PKIaaS.io as built-in CA option, deprecate BuyPass as a supported CA as they have discontinued their ACME service.
• Fixes:
  • Data Stores: Arm64 SQLite database fixes

7.0.5 : 2025-07-29

• Enhancements:
  • Stored Credentials: Implement optional unlockable stored credentials (allowing specific secrets to be read via API for custom scripts etc).
  • Core: Add Actalis as a built-in CA configuration
  • Core: Cert CN (deprecated by CAs) is no longer set in CSR unless the configuration specifically requires it.
• Fixes:
  • Renewals: address possible hang during long running renewal batches which then prevents subsequent renewal batches from running.

7.0.4 : 2025-07-03

• Enhancements:
  • Updated support for monitoring certs managed by external cert managers on same instance:
    • Certbot
    • acme.sh
    • win-acme & simple-acme
    • Posh-ACME

7.0.3 : 2025-06-12

• Enhancements:
  • DNS: Add NameSilo DNS provider
  • Dashboard: Remove status reports if item deleted
  • Updated dependencies

7.0.2 : 2025-05-21

• Minor Updates

7.0.1 : 2025-05-05

• Enhancements:
  • Hub service now includes default hubservice.json config for configuration of https and preferred host:port
• Fixes:
  • /docs/api shows available API
  • Log plugin errors on service load
  • Implement Certificate > Security options (Custom CSR, Custom Key, PFX password etc)

7.0.0 : 2025-04-29

• Introducing Certify Management Hub (alpha)

---