Enterprise Issuer for Next-Gen Trust Security releases¶

Learn about current and past releases of Enterprise Issuer for Next-Gen Trust Security.

Helm charts are public, but container images require a pull secret. See Configuring access to the NGTS registry.

Release 0.24.0¶

Enterprise Issuer for Next-Gen Trust Security 0.24.0 was released on 27 October, 2026.

Key features¶

• This release removes trust in the compromised eMudhra certificate authority (CA).

Fixes and updates¶

• Updated the base image.
• Updated Go to v1.27.3 to address CVE-2026-111943.

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer:v0.24.0
• Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer-fips:v0.24.0
• Standard image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer:v0.24.0
• FIPS image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer-fips:v0.24.0

Release 0.23.0¶

Enterprise Issuer for Next-Gen Trust Security 0.23.0 was released on 14 October, 2026.

Key features¶

• Enterprise Issuer now supports Built-in Accounts that belong to a workspace. Set spec.ngts.workspaceID in your VenafiConnection. Without it, the token request fails with a Not found error. Upgrading the Helm chart adds this field to the VenafiConnection CRD. See Authenticate to Next-Gen Trust Security with Workload Identity Federation.

Fixes and updates¶

• You can now set zone to a request policy ID. If more than one request policy has the same name, Enterprise Issuer reports an error, and you can set zone to the ID of the one you want.
• Addressed an issue where Enterprise Issuer did not record Kubernetes events, so they did not appear in kubectl describe.

• Updated the following dependencies:

  • Go to v1.27.2
  • venafi-connection-lib to v0.7.0
  • cel-go to v0.31.0
  • Kubernetes Go libraries to v0.37.0
  • controller-runtime to v0.25.0

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer:v0.23.0
• Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer-fips:v0.23.0
• Standard image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer:v0.23.0
• FIPS image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer-fips:v0.23.0

Release 0.22.0¶

Enterprise Issuer for Next-Gen Trust Security 0.22.0 was released on 5 August, 2026.

Fixes and updates¶

• This release updates Go and other dependencies to address three newly disclosed vulnerabilities:

  • Go was updated to v1.26.5 to address CVE-2026-39822.
  • Bundled Go dependencies were updated to address CVE-2026-56852 and CVE-2026-46600.

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer:v0.22.0
• Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer-fips:v0.22.0
• Standard image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer:v0.22.0
• FIPS image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer-fips:v0.22.0

Release 0.21.0¶

Enterprise Issuer for Next-Gen Trust Security 0.21.0 was released on 3 July, 2026.

Features and updates¶

• You can now customize certificate metadata for all certificates produced by an issuer. To do this, add the new venafi.cert-manager.io/custom-fields annotation to the VenafiIssuer or VenafiClusterIssuer resources. See Configuring Enterprise Issuer for CyberArk Certificate Manager.
• Change where the venafi-connection service account and role-based access control are installed with a new venafiConnection.serviceAccountNamespace Helm value. This value defaults to the namespace where Enterprise Issuer runs.

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer:v0.21.0
• Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer-fips:v0.21.0
• Standard image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer:v0.21.0
• FIPS image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer-fips:v0.21.0

Release 0.20.0¶

Enterprise Issuer for Next-Gen Trust Security 0.20.0 was released on 1 June, 2026.

Key features¶

• Enterprise Issuer now supports Workload Identity Federation (WIF) for authenticating to Next-Gen Trust Security. With WIF, Enterprise Issuer authenticates through a Kubernetes ServiceAccount token instead of a stored private key. To learn more, see Authenticate to Next-Gen Trust Security with Workload Identity Federation.

Fixes and updates¶

• Removed the vcert library as a dependency.

• Updated the following dependencies:

  • Go to v1.26.3
  • venafi-connection-lib to v0.6.1
  • cel-go to v0.28.1
  • zap to v1.28.0
  • Kubernetes Go libraries to v0.36.1
  • controller-runtime to v0.24.1

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer:v0.20.0
• Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer-fips:v0.20.0
• Standard image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer:v0.20.0
• FIPS image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer-fips:v0.20.0

Release 0.19.1¶

Enterprise Issuer for Next-Gen Trust Security 0.19.1 was released on 8 May, 2026.

Key features¶

• Enterprise Issuer now supports certificate issuance from Next-Gen Trust Security. Configure a VenafiConnection with the new spec.ngts field to authenticate using the private key from a Built-in Account. See Authenticate to Next-Gen Trust Security with a private key.

Fixes and updates¶

• The Helm chart image template helper has been renamed to avoid conflicts when Enterprise Issuer is deployed as a sub-chart within an umbrella chart.

• Updated the following dependencies:

  • Go to v1.26.2
  • venafi-connection-lib to v0.6.0
  • cert-manager to v1.20.2
  • issuer-lib to v0.10.0
  • Kubernetes Go libraries to v0.35.4
  • controller-runtime to v0.23.3

Downloads¶

• Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer:v0.19.1
• Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/enterprise-issuer-fips:v0.19.1
• Standard image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer:v0.19.1
• FIPS image: registry.ngts.paloaltonetworks.com/enterprise-issuer/enterprise-issuer-fips:v0.19.1