Product Enhancements

What's New: Enhancements and Software Version Updates¶

Come here to learn about our latest feature enhancements and software version releases.

TIP

Looking for all of our newest and coolest product capabilities? Check out What's New.

Discovery Agent for CyberArk Certificate Manager in Kubernetes and OpenShift Environments 1.12.0 released¶

28 September 2026

This release updates the base image, and updates Go and other dependencies to address reported security vulnerabilities. Learn more

CLI tool for CyberArk Certificate Manager 1.30.0 released¶

22 September 2026

This release updates the default component versions available for installation. It also updates Go and other dependencies. Learn more

Enterprise Approver Policy 0.26.0 released¶

21 September 2026

This release enforces key type and key size in TLS Protect Datacenter 25.1+ policy folders and updates dependencies to address reported security vulnerabilities. Learn more

Common KeyStore certificate discovery¶

18 September 2026

CyberArk Certificate Manager - SaaS can now discover the certificates already deployed on your Linux and Windows hosts. Point a Common KeyStore machine at a keystore file or at a directory to scan, and Certificate Manager - SaaS reads the PEM files, Java keystores, and PKCS#12 archives it finds over the machine's existing SSH or WinRM connection. Directory scans can recurse into subdirectories and filter by file extension, and you can supply a list of passwords to open encrypted keystores. Learn more

Istio CSR 0.18.0 released¶

18 September 2026

This release updates gRPC to address a reported security vulnerability. Learn more

OpenShift Routes for cert-manager 0.11.0 released¶

18 September 2026

This release updates Go and other dependencies to address reported security vulnerabilities. Learn more

cert-manager 1.20.4 released¶

16 September 2026

This patch release updates Go and other dependencies to address reported security vulnerabilities. Learn more

Approver Policy 0.28.0 released¶

16 September 2026

This release updates dependencies to address reported security vulnerabilities. Learn more

Trust Manager 0.25.0 released¶

11 September 2026

This release hardens webhook TLS configuration and CA handling, and updates dependencies to address reported security vulnerabilities. Learn more

cert-manager 1.21.2 released¶

11 September 2026

This patch release fixes several stability and security issues. It also updates Go and other dependencies to address reported vulnerabilities. Learn more

HSM high availability mode for HSM-protected DEK¶

10 September 2026

If your tenant uses an HSM-protected data encryption key (DEK), the HSM can now run in high availability (HA) mode. Create a virtual slot on the HSM so that its member partitions operate together as a cluster, then set --partition-label to the label of the virtual slot when you install the VSatellite. Learn more

cert-manager 1.17.9 LTS released¶

31 August 2026

This patch release addresses vulnerabilities by upgrading Go to v1.25.14 and rebuilding FIPS images on an updated Red Hat Universal Base Image 8 (UBI8). Learn more

Google Private CA for Workload Identity Manager¶

26 August 2026

Workload Identity Manager now supports Google Cloud Certificate Authority Service as a source for subordinate CA certificate issuance. Connect a Google CA service account, then create a Sub CA provider that signs Workload Identity Manager's CA certificate from a Google Cloud CA pool. Learn more

Istio CSR 0.17.0 released¶

14 August 2026

This release updates Go and other dependencies to address several security vulnerabilities, and makes minor improvements to the Helm chart. Learn more

Citrix ADC PFX discovery support¶

13 August 2026

CyberArk Certificate Manager - SaaS now supports discovery of password-protected PFX files on Citrix ADC machines. This enhancement allows you to discover and monitor PFX certificates during machine discovery runs, expanding certificate visibility and management capabilities for Citrix ADC deployments. Learn More

Cloudflare dual certificate pack support¶

11 August 2026

CyberArk Certificate Manager - SaaS now correctly provisions both ECC and RSA certificates to Cloudflare zones configured with dual certificate packs (modern + legacy). Previously, provisioning a second certificate to the same zone would time out and report failure. Both certificates now install successfully, and the machine identity status correctly reflects INSTALLED for both certificates.

CSI Driver for SPIFFE 0.15.0 released¶

5 August 2026

This release updates dependencies to fix several vulnerabilities. Learn more

CSI Driver 0.16.0 released¶

5 August 2026

This release adds a flag to control how long CSI Driver waits when checking if certificates are ready and updates dependencies to fix several vulnerabilities. Learn more

Enterprise Issuer for CyberArk Certificate Manager 0.22.0 released¶

5 August 2026

This release updates Go and bundled dependencies to address three newly disclosed vulnerabilities. Learn more

Enterprise Approver Policy 0.25.0 released¶

31 July 2026

This release addresses two security issues and updates dependencies. It has a known limitation when used with TLS Protect Datacenter 25.1+, so confirm before upgrading. Learn more

Approver Policy 0.27.0 released¶

30 July 2026

This release fixes two issues where certain SAN entries and Subject attributes could end up in an issued certificate despite not being checked against a policy. It also updates several dependencies. Learn more

OpenShift Routes for cert-manager 0.10.0 released¶

30 July 2026

This release fixes a security issue where a forged certificate could cause OpenShift Routes for cert-manager to expose the wrong TLS secret, adds a warning against relying on OpenShift Routes for cert-manager as a boundary between tenants sharing a namespace, and updates dependencies to address several vulnerabilities. Learn more

cert-manager 1.21.1 released¶

29 July 2026

This patch release fixes a controller panic and unnecessary logging. It also updates dependencies to address security vulnerabilities. Learn more

cert-manager 1.17.8 LTS released¶

28 July 2026

This release fixes a high-severity security issue that could let a user obtain a ClusterIssuer's DNS credentials, and updates Go and several dependencies. Learn more

Post-quantum ready certificates in Zero Touch PKI¶

22 July 2026

Zero Touch PKI can now issue post-quantum ready certificates using SLH-DSA (FIPS 205), a conservative hash-based alternative to ML-DSA for high-value roots of trust where long-term resistance outweighs signature size and speed. Learn more

cert-manager 1.21.0 released¶

9 July 2026

This release adds certificate renewal policies and a configurable cap on the retry delay for failed certificate requests. Learn more

Enterprise Issuer for CyberArk Certificate Manager 0.21.0 released¶

3 July 2026

Enterprise Issuer now supports default custom fields at the issuer level with annotations. In addition, you can now set its service account and RBAC install location with a Helm value. Learn more

IBM DataPower Gateway discovery supports filtering by certificate usage type and application domain¶

29 June 2026

When configuring discovery for IBM DataPower Gateway machines, you can now filter by certificate usage types (HTTPS listeners, outbound TLS, signing credentials, trust anchors, management interfaces, or unbound certificates) and scope discovery to a specific application domain. This allows you to focus discovery on the certificates most relevant to your operations. Learn more

Trust Manager 0.24.0 released¶

27 June 2026

This release lets you set your own security settings for Trust Manager pods and containers through the Helm chart. Learn more

cert-manager 1.20.3 released¶

25 June 2026

This patch release fixes a high-severity security issue in the default edit role and updates Go to address reported vulnerabilities. Learn more

Update authentication methods on existing GCP cloud providers¶

24 June 2026

Update the authentication method on existing Google Cloud Platform cloud provider configurations without recreating the provider. Switch between Workload Identity Federation (built-in or Azure identity provider) and vSatellite Generated Key. Existing configuration, keystores, and certificates are preserved. Learn more

Approver Policy 0.26.0 released¶

18 June 2026

This release hardens Common Expression Language (CEL) policy evaluation against denial-of-service from resource-intensive policies. Learn more

CSI Driver for SPIFFE 0.14.0 released¶

17 June 2026

For better compliance, SPIFFE certificate signing requests now mark the Subject Alternative Name extension as critical. Learn more

CSI Driver for SPIFFE 0.13.0 released¶

10 June 2026

New flags enable CSI Driver for SPIFFE to use its own Kubernetes service account and to auto-approve non-SPIFFE certificate signing requests. Learn more

CyberArk Workload Identity Manager 1.12.0 released¶

9 June 2026

HTTPS is now required for JWKS and OIDC endpoints. Learn more

Discovery Agent for CyberArk Certificate Manager in Kubernetes and OpenShift Environments 1.11.0 released¶

4 June 2026

You can now install the Connection for CyberArk Certificate Manager custom resource definition from the Discovery Agent Helm chart. Discovery Agent also now redacts GitOps tool annotations that may contain secret material. Learn more

Auto-Enrollment Connector 2.2.2 for Zero Touch PKI released¶

2 June 2026

This release addresses an issue in Auto-Enrollment Connector 2.2.1 where the Citrix Federated Authentication Service (FAS) integration failed when the Remote Host configuration included a domain name. This release was validated on Windows Server 2025 (Desktop Experience). Download here

Enterprise Issuer for CyberArk Certificate Manager 0.20.0 released¶

1 June 2026

This release removes the vcert dependency and updates Go and other dependencies. Learn more

VSatellite health status events now logged in event log¶

28 May 2026

VSatellite health status changes are now logged in the Certificate Manager - SaaS event log in addition to email notifications. When a VSatellite becomes unhealthy or returns to a healthy state, an entry is created in the event log, providing administrators with better visibility and audit trails for VSatellite connectivity issues. Learn more

CSI Driver 0.15.0 released¶

21 May 2026

This release renames the image helper template and updates dependencies. Learn more

VSatellite Release Notes Now Available¶

18 May 2026

A dedicated release notes section for VSatellite is now available in the documentation. This section provides detailed information about version updates, including new features, bug fixes, and improvements across releases. Engineering will update this section with each new VSatellite release to keep you informed of the latest changes. Learn more

CLI tool for CyberArk Certificate Manager 1.29.0 released¶

15 May 2026

This release updates Go. Learn more

Enterprise Issuer for CyberArk Certificate Manager 0.19.0 released¶

11 May 2026

This release improves health check error messages and renames the Helm chart image helper to avoid chart conflicts. Learn more

CyberArk Workload Identity Manager 1.11.0 released¶

7 May 2026

This release adds support for Workload Identity Federation (OIDC) authentication, allowing Workload Identity Manager to authenticate with Certificate Manager - SaaS using Kubernetes service account tokens without requiring private keys. Learn more

Discovery Agent for CyberArk Certificate Manager in Kubernetes and OpenShift Environments 1.10.0 released¶

7 May 2026

This release updates Go and other dependencies. Learn more

Approver Policy 0.25.1 released¶

1 May 2026

This patch addresses a Helm umbrella chart compatibility issue. Learn more

Connection for CyberArk Certificate Manager 0.6.0 released¶

30 April 2026

This release includes the vCert library directly in the codebase, removing it as an external dependency. Learn more

cert-manager 1.19.5 released¶

21 April 2026

This patch release updates Go and dependencies to address reported vulnerabilities. Learn more

Approver Policy 0.25.0 released¶

18 April 2026

This patch release aligns Helm chart image references with their regional registries and simplifies custom registry configuration. Learn more

Trust Manager 0.22.1 released¶

17 April 2026

This patch release updates Go and dependencies to address vulnerabilities reported by scanners. Learn more

CSI Driver 0.14.0 released¶

17 April 2026

This release adds a FIPS-compliant Helm chart and a new --continue-on-not-ready flag that allows CSI Driver to not block pod startup when the certificate being issued is not ready. Learn more

CyberArk Workload Identity Manager 1.9.4 released¶

14 April 2026

This patch release fixes an issue where Workload Identity Manager failed to start when the gRPC server used a Unix domain socket, and updates Go and other dependencies. Learn more

CyberArk Workload Identity Manager 1.10.4 released¶

14 April 2026

This patch release fixes an issue where Workload Identity Manager failed to start when the gRPC server used a Unix domain socket. It also updates Go and other dependencies. Learn more

cert-manager 1.20.2 released¶

11 April 2026

This patch release fixes invalid YAML in the Helm chart and updates Go to v1.26.2. Learn more

Single sign-on is now self-service in Zero Touch PKI¶

2 April 2026

You can now configure single sign-on (SSO) directly in Zero Touch PKI. Prior to this release, SSO setup required coordination with CyberArk to add identity provider details to your instance. Learn more

cert-manager 1.20.1 released¶

27 March 2026

This patch release fixes a duplicate field issue in the Gateway API resource, adds missing OpenShift RBAC, and updates gRPC. Learn more

CyberArk Workload Identity Manager 1.10.3 released¶

20 March 2026

This patch release updates Go-related dependencies to address CVE-2026-33186. Learn more

Enterprise Approver Policy for CyberArk Certificate Manager 0.24.1 released¶

16 March 2026

This patch release aligns Helm chart image references with their regional registries and simplifies custom registry configuration. Learn more

CyberArk Certificate Manager Operator for Red Hat OpenShift 1.9.2 released¶

16 March 2026

This release includes a number of dependency updates to address CVE-2025-68121. Learn more

Enterprise Approver Policy for CyberArk Certificate Manager 0.24.0 released¶

11 March 2026

This release updates the version of Go used to v1.26.1. Learn more

CLI tool for CyberArk Certificate Manager tool 1.28.0 released¶

10 March 2026

Release v1.28.0 addresses several CVEs by updating Go and other dependencies, and updates the default install versions of several Kubernetes components. Learn more