Secure Software Manager

CSR generation support from API and UI - To better support end entity certificate issuance from non-Digicert managed PKI hierarchies, SSM has now extended the CSR generation for SSM protected keypairs both in secure disk and on HSM. This will allow users to get CSRs for their protected keys and bring those CSRs to other CA service providers like in popular use-cases for Apple CA and Microsoft CA amongst others.

Advanced GPG Signing Workflows - Building upon the June MVP release for GPG Keypairs, in this release we now bring more keypair feature parity for GPG Keypairs as is the case for traditional keypairs. GPG Keypairs now accommodate keypairs being brought online and offline as well as support for keypair deletion. We have also introduced capabilities for GPG keypairs to be created on HSM to complement the secure key storage, but please note HSM keypairs do not support import or export now or in the future. Finally, we have brought parity to GPG Test Keypairs whereby test keys will expire after 30 days like is the case with traditional keypairs.

Manual Refresh of dynamic and rotation pool keys - In this release, we have given SSM users additional optional manual controls to help tailor their signing workflows for dynamic keys and rotation keys. As a result, users can now refresh their dynamic keys at any time via the SSM UI, via SSM APIs or by using the SMCTL (CLI) which will give users confidence that the key and certs being used to sign have now been used before. We also delivered equivalent functionality for Keypair rotation pool, where if required users can force the keypair rotation ahead of the planned rotation schedule via the SSM UI, via SSM APIs or by using the SMCTL (CLI).

SMCTL Sign no longer requires user to provide local cert for windows signing - Until this release, users undertaking Microsoft signing had to either sync the certificate to their certificate store or download the public version of the certificate to allow for signing using Signtool, Nuget, Mage etc… We have now removed the burden on the customer to download/sync the cert before signing when our users use the SMCTL to sign. Going forward, users who use the most recent SMCTL release just need to supply the keypair alias relative to signing and our SMCTL will download the current default certificate associated with the keypair so that it can be used for signing. This process works for static keypairs (production and test), dynamic keypairs (production and test) and keypairs rotation pools (production only).