Product Enhancements: 2023¶
Entries from 2023. For the latest, see Product Enhancements.
Certificate expiration notifications¶
20 December 2023
You now have the ability to configure the certificate monitoring service in the UI, and certificate expiration notifications can now be sent via email. Staying aware of certificate expirations significantly reduces the likelihood of certificate-related outages. Learn more
Certificate expiration reports¶
19 December 2023
To help you stay on top of certificates nearing expiration and recently expired, you can now configure certificate expiration reports. These are CSV-formatted reports that show expiring and recently expired certificates, based on how you configure the report. Certificate Manager - SaaS emails the reports to specific recipients at an interval that you define. Learn more
CLI tool for CyberArk Certificate Manager 1.3.0 released¶
15 December 2023
Release 1.3.0 of the CLI tool for CyberArk Certificate Manager adds a new venctl iam service-accounts delete command for deleting service accounts in the Certificate Manager - SaaS. Learn more
This release addresses an issue in the Kubernetes manifest for the Trust Manager. Previously, the generated manifest pulled the open-source image for the default trust package, now the enterprise Trust Manager version is used unless another registry is configured.
Workload Identity Manager 1.3 released¶
8 December 2023
For special cases like SPIRE where gRPC clients are co-hosted with Workload Identity Manager, certificates can now be requested using Unix Domain Sockets (UDS) to avoid the overhead of networking, TLS, and authentication. Learn more
We've added a HTTP server endpoint with GET /chain method to Workload Identity Manager that allows Trust Managers to obtain the CA certificates applicable to certificates issued by Workload Identity Manager. Learn more
The timeout for Workload Identity Manager interactions with Certificate Manager - SaaS has been increased from 10 to 30 seconds to be more tolerant of cases where network latency is not optimal.
Service accounts access to the Venafi OCI registry¶
8 December 2023
Organizations that use the Certificate Manager - SaaS, and are entitled to CyberArk Certificate Manager for Kubernetes, can get access to Kubernetes components such as cert-manager, Enterprise Issuer for CyberArk Certificate Manager, and Enterprise Approver Policy for CyberArk Certificate Manager. Your organization can use these components to control the certificate lifecycle management on Kubernetes environments efficiently.
Access to components depends on the organization tier. Learn more
Guidelines and metrics for enterprise components¶
8 December 2023
Platform teams can now implement best practices for installing, upgrading, and backing up CyberArk Certificate Manager for Kubernetes components based on guidelines from the subject matter experts. Learn more
Additionally, operational metrics of the enterprise components are now exposed, and can be consumed by Prometheus and Grafana, supporting platform teams in ensuring high-quality certificate management services. Learn more
Kubernetes manifests¶
6 December 2023
To assist platform teams following best practices in managing Kubernetes components, has improved the CLI tool for CyberArk Certificate Manager tool to support CyberArk Certificate Manager for Kubernetes manifests. These manifests enable your organization to properly install interdependent enterprise components for Kubernetes while following GitOps practices. Learn more
Self-updater for CLI tool for CyberArk Certificate Manager¶
6 December 2023
Starting from version 1.2.0, the CLI tool for CyberArk Certificate Manager enables you to seamlessly and securely update your instance using the self-update feature. Learn more
Certificate Provisioning for Azure Key Vault¶
6 December 2023
You can now enable Certificate Manager - SaaS to provision new certificates in Azure Key Vault (AKV) for use with Azure services. Learn more
Re-provision & replace certificate with Amazon ACM¶
5 December 2023
Now, you have the capability to re-provision or replace an existing certificate in Amazon ACM. These options allow you to modify an existing machine identity (existing installation). Learn more
Provision with A10 Thunder ADC¶
29 November 2023
You can now provision a certificate to an existing virtual server on your A10 Thunder ADC connectors or use Certificate Manager - SaaS to create a new virtual server setting. Learn more
Scheduling functionality for Machine Discovery¶
20 November 2023
Effortlessly run your machine discoveries by enabling the scheduling functionality on your F5 BIG-IP LTM, Microsoft IIS, and VMWare NSX (AVI) machines. Learn more
Certificate Provisioning for Amazon ACM¶
8 November 2023
You can now enable Certificate Manager - SaaS to provision new certificates in AWS Certificate Manager (ACM) for use with AWS services. Learn more
Workload Identity Manager 1.2.1 released¶
1 November 2023
You can now use gRPC to request certificates using a public key plus Subject and SAN metadata. Learn more
We've also resolved issues involving default key type from policy being ignored and another involving certificate requests with no CN being rejected when policy specified CN as optional.
Certificate auto-renewal and auto-provisioning¶
11 October 2023
Certificate Manager - SaaS now includes the ability to automatically renew and provision certificates. Automated certificate renewal eliminates the need for manual updates, significantly reducing the risk of service interruptions due to expired certificates. Learn more
Streamlined certificate approval workflow¶
28 September 2023
We've updated Certificate Manager - SaaS with a streamlined certificate approval process to enhance security and reduce complexity. New features include conditional rules and configurable notifications. Administrators now have greater control, while requesters can expect faster turnarounds. Learn more
Introducing the vsatctl preflight command¶
25 September 2023
Experience a smoother VSatellite deployment with the new vsatctl preflight command. This tool swiftly checks your environment and prerequisites, streamlining the installation process and enhancing reliability. Learn more
Discover and provision with VMware NSX ALB (AVI)¶
21 September 2023
You can now provision certificates and perform machine-based discovery for your VMware NSX ALB (AVI) connectors. VMware NSX ALB (AVI) helps users provision certificates to virtual services and facilitates seamless tracking of certificates already deployed to your machines within your environment. Learn more
Provision with Imperva WAF¶
21 September 2023
You can now provision a certificate to an existing SSL server on your Imperva WAF connectors or use Certificate Manager - SaaS to create a new SSL virtual server setting. Learn more
Terminology update in Certificate Manager - SaaS¶
18 September 2023
Within the Certificate Manager - SaaS interface, we've updated our terminology to be more descriptive. The term "Local login", which previously referred to signing in using a username and Control Plane password, will now be referred to as "email sign-in". This change more accurately reflects its function. As we transition, you might still come across references to "Local login". Learn more
Updated certificate terminology¶
14 September 2023
To enhance clarity in TLS management, we've introduced a new term: "TLS Server Endpoints." This refers to the network locations where certificates are presented, providing details like IP addresses, ports, and server names. Look for the new TLS Server Endpoints page, which replaced "Certificate Installations." Learn more
Improved sign-in experience¶
12 September 2023
We've enhanced your sign-in experience with new Company Domain URLs and a revamped UI. No action needed on your end! Your tenant will automatically receive a Company Domain URL based on the creator's email domain. For instance, if the creator's email is "user@company123.com," your new URL will be company123.venafi.cloud.
Non-interactive installation for VSatellite¶
6 September 2023
VSatellite now supports a non-interactive installation with the --accept-license-agreement flag, streamlining the automation process. This aligns with the Workload Identity Manager installation method, ensuring a consistent experience. By using this flag, you're accepting the Venafi End User License Agreement. Learn more
Certificate Manager - SaaS EU service region now available¶
5 September 2023
Certificate Manager - SaaS, Certificate Manager - SaaS, and Workload Identity Manager are now available to our European customers, addressing EU data residency requirements and GDPR compliance. This update furthers CyberArk's commitment to meeting global business needs and support our growing customer base in Europe.
Workload Identity Manager 1.2 released¶
5 September 2023
A new minor version of the Workload Identity Manager on-prem component has been released. This includes support for Instance Identity Documents from Azure and Google (in addition to AWS), so Workload Identity Manager now supports all three major cloud providers. Additionally, the End User License Agreement for Workload Identity Manager is incorporated into the CyberArk standard EULA. Please review the CyberArk EULA before upgrading. Learn More.
vCert 5.1 enhances certificate management with Playbook¶
30 August 2023
The latest VCert release introduces a YAML-configurable VCert Playbook for streamlined certificate management and expands issuing capabilities via Workload Identity Manager in both SDK and CLI. This enables users to configure certificate requests, renewals, and TLS server endpoints via Playbook. Learn more
Machine discovery (F5 BIG-IP LTM & Microsoft IIS integration)¶
17 August 2023
With Certificate Manager - SaaS, machine-based discovery just got simpler. Seamlessly track certificates on your machines. This enhancement helps you quickly identify certificates that have been added or removed and manage them appropriately. Learn more
CyberArk Workload Identity Manager 1.1 released¶
9 August 2023
A new minor version of the CyberArk Workload Identity Manager on-prem component has been released. This release features new AWS authentication endpoints using AWS workload identity documents, as well as the addition of a Helm chart, simplifying the installation of Workload Identity Manager in a Kubernetes cluster. Learn more
CyberArk connector now available in Certificate Manager - SaaS¶
20 July 2023
The Certificate Manager - SaaS integration with CyberArk allows Certificate Manager - SaaS to access credentials stored in a CyberArk vault when performing functions like provisioning certificates to machines. This allows you to use Certificate Manager - SaaS to manage the certificate lifecycle on your machines while continuing to use CyberArk to manage privileged credentials. Learn more
Enhanced Dev Central site¶
30 June 2023
Visit the enhanced Dev Central site, your go-to destination for access to essential resources for Certificate Manager - SaaS, Certificate Manager - SaaS, and Workload Identity Manager. With the redesigned homepage, you can easily explore comprehensive guides, API documentation, and recipes for these powerful products. Learn more)
Workload Identity Manager and Certificate Manager - SaaS update: added Certificate Manager - Self-Hosted as a provider for subordinate CA certificate issuance¶
23 June 2023
Configure Workload Identity Manager to use Venafi's TLS Protect Data Center as a CA for issuing intermediate certificates. Learn more
Webhooks: added support for Microsoft Teams¶
2 June 2023
Forward events and notifications to a Microsoft Teams channel using webhooks and the Connectors API. Learn more
User management: disable (or re-enable) users and their associated API keys¶
2 June 2023
Offboard specific users by disabling their accounts and associated API keys. Learn more
Tagging: easier creation of key:value pairs for certificates¶
10 April 2023
Tags allow you to add customized meta information to certificates beyond just the certificate properties. Learn more
Introducing Venafi CyberArk Workload Identity Manager: the decentralized certificate issuance solution that is both DevOps-friendly and security-approved¶
4 April 2023
If your environment requires rapid issuance of a large number of enterprise-trusted certificates to support your applications, Workload Identity Manager is the perfect choice. Learn more