Signotaur 릴리스

• Changes:
• Mail server TLS certificates are now validated. If your mail server uses a self-signed certificate or an internal certificate authority that Signotaur does not trust, outgoing mail will stop. Trust the authority on the server or select Accept any certificate under Settings, Email, then use Send test message to verify the configuration.
• Google and GitHub registrations now require approval. A new user signing in through either provider creates a request on the Users page and administrators are notified by email. Existing users retain access. Under Settings, Authentication, you can restrict requests to verified email domains or refuse them entirely. Individual administrators can disable these notifications under Profile, Email without affecting others.
• The server data directory now has restricted permissions. The installer grants access to the service account, which no longer needs administrator rights, only "log on as a service". The log directory remains readable. If you change the service account outside the installer, re-run the installer or run 'VSoft.Signotaur.Server.exe configure' as an administrator.
• The configured sign-in durations now take effect. 'Remember me expiry' and 'Two-factor remember-me expiry' previously used a fixed 14 days. Their defaults are 14 and 30 days respectively, so an installation that never changed them will find two-factor remember-me lengthens from 14 days to 30. Check both settings before upgrading if you intended to use shorter periods.
• Reverse proxies must be trusted explicitly to preserve client addresses. Add the proxy to 'TrustedProxies' and restart the server. Until then, the audit log records the proxy's address for every request. See Recording the Original Client Address.
• Unauthorised certificate requests now return a not-found result. 'SignotaurTool' therefore returns a different exit code. Check pipelines that depend on the previous access-denied code against the exit code reference.
• SFTP publishing of revocation list and CA certificates now warns when the destination's SSH host key is not checked. Publishing continues, but the SFTP password could be exposed if the connection is intercepted. Pin the host-key fingerprint or authenticate with a private key to remove the warning.
• Password reset is no longer available for accounts that sign in only through Google or GitHub. These accounts have no Signotaur password, and resetting one would allow sign-in without the provider or any second factor it enforces. The Reset Password action and Forgot password link now decline the request. To add a password, the account holder can set one under Profile, Change Password.
• Security
• Accounts are temporarily locked after repeated failed sign-in attempts. Administrators can clear a lockout by re-enabling the account. Active sessions are also rechecked periodically, so disabled accounts and role changes take effect without waiting for the session to end.
• Two-factor authentication is better protected. Viewing an existing authenticator key now requires the Signotaur password or a current authenticator code. Any change, including displaying the key, emails the account holder providing a mail server is configured.
• Browser-facing security has been strengthened with HTTP Strict Transport Security, secure cookies, anti-forgery protection, a content security policy and other protective headers. Signotaur can no longer be displayed inside a frame, and rejected anti-forgery submissions are recorded on the Events page. HSTS is not applied to subdomains or the Validation Authority's plain-HTTP port, and new 'Site.HstsMaxAgeDays' setting in the configuration file controls how long browsers remember it.
• Sign-in, password-reset and email-confirmation requests no longer reveal whether an account exists. Two unused endpoints that could confirm a username have been removed.
• 'archive restore' now blocks backups that write outside their intended directory or specify an implausible key-derivation cost. It also warns when a restored configuration places a certificate authority's private key outside the data directory. Restore only backups you produced yourself.
• Client downloads and update checks now require a signed-in session, and the update badge is hidden when signed out. An update-feed redirect is followed only when it carries a valid VSoft signature.
• Event entries, error messages and API responses no longer expose full server paths. Security events now record the client address.
• Secrets in the server configuration are now stored using a stronger encryption method that gives each value a distinct result and detects tampering. Existing secrets continue to work.
• Improvements
• Administrators can now resend the verification email from the Users page for any unverified address. Changing a user's email address also sends one automatically, since the new address starts unverified.
• Save confirmation dialogs now show potentially harmful consequences as warnings. These include shortening retention, disabling an issuer or automatic renewal, relaxing certificate checks, disabling rate limiting and changing the backup passphrase.
• When the server has no internet access, update checks now fall back to the browser. Failed checks are cached briefly to avoid repeated requests and warnings.
• User avatars are now fetched by the server, so browsers no longer contact Gravatar directly. Set 'UI.EnableGravatar' to 'false' to disable these lookups and display initials for every account.
• Email failures now give administrators the reason and configuration location, while other users are directed to an administrator. The full reason is always recorded in the log.
• Certificate authority expiry warnings are now sent only while the server holds an Enterprise license, since the certificate authority cannot be renewed or regenerated without one. The preference is hidden and the settings are kept; installing a license resumes the warnings.
• Enabling, disabling or deleting an API key now reports the outcome, and its row remains accurate if the change fails.
• Some minor UI updates.
• Infrastructure:
• The server now requires .NET Runtime 10.0.11, which the installer installs if missing.
  Various third-party package updates.

• Fixed changing a user's administrator status removing every other role they held, including the API key rotator role granted in the same save.
• Fixed a two-factor recovery code remaining usable after it had been redeemed.
• Fixed an issue where an account could become unreachable after an administrator changed the email address. An administrator can also no longer change an address to one that another account already uses.
• Fixed Microsoft AD CS certificate enrolment holding a server thread while it waited for the CA, which could slow the server under load.
• Fixed the temporary password warning on the Change Password page remaining after the password was changed. The time remaining now also counts down while the page is open instead of only updating after a reload.
• Fixed an authorization flaw that allowed a signed-in user to act on API keys belonging to other users.

New Enterprise Features

• Document signing. 'SignotaurTool' can now produce ETSI Advanced Electronic Signatures as well as code signatures. XML files are signed as XAdES and PDFs as PAdES; other files can be signed as CAdES with '--format cades'. Choose the signature level with '--level': 'baseline', 'timestamped', 'long-term' or 'archival'. Long-term and archival signatures embed the certificate chain and revocation evidence, helping them to remain verifiable after the signing certificate expires. PDF signatures can have a visible appearance, and encrypted PDFs can be signed. The 'verify' command recognizes all three formats.
• Document-signing certificates. Document-signing certificates can now be registered alongside code-signing certificates, or issued from the Internal CA or Microsoft AD CS. Certificates issued by Signotaur carry the Microsoft, Adobe and RFC 9336 document-signing usages, so they are accepted by Adobe Acrobat and by other verifiers. Certificates registered before upgrading are recorded as code signing; re-register one to pick up a second purpose.
• Validation Authority. The Internal CA can now publish revocation information for the certificates it issues, answering OCSP requests and publishing CRLs and CA certificates, optionally over a dedicated plain HTTP port. Certificates can be revoked from the managed certificates list, and are revoked automatically when deleted or replaced by a renewal. The CRL and CA certificates can also be published to an external destination over SFTP, FTP/FTPS, WebDAV or S3-compatible storage, so that revocation can be checked from outside your network. Only certificates issued after the Validation Authority is enabled carry its addresses; existing certificates cannot be updated.
• Multiple Intermediate CAs. The Internal CA is no longer limited to a single intermediate. Several can now be added, each scoped to web (TLS), code signing, document signing or all purposes. Each can be reissued or paused independently. Existing installations keep their current intermediate as an all-purpose one.
• Certificate identities and policies. Issued signing certificates can now carry a full structured subject following ETSI EN 319 412-2/-3, identifying either a natural person or an organization, with email addresses as subject alternative names. Renewal preserves the whole subject rather than reducing it to the common name. Certificates can also state the ETSI EN 319 411-1 policy they were issued under (LCP, NCP or NCP+), with an optional link to your CP/CPS.

Improvements

• The managed certificates list gains a Certificate authorities view, showing each Root with its Intermediate CAs nested beneath it, and now marks both the certificate currently served by the web interface and any revoked certificates. A whole certificate chain can be downloaded as a single PEM or '.p7b' file.
• The Code Signing Certificates page is now Signing Certificates, and both it and My Certificates gain a Purpose column and filter where document signing is licensed. My Certificates now shows the same certificate details as the administration page.
• Renewal now re-signs a certificate under the intermediate that originally issued it rather than the newest one, so a certificate no longer moves to a different CA.
• Regenerating the Root CA no longer requires a restart unless the web certificate was issued by the Internal CA and must also be reissued.
• Website Settings now warns that changing the server address will make the revocation addresses already stored in issued certificates unreachable.

Changes

• The signing certificate's purpose is now enforced before signing begins. If the certificate is unsuitable for any artefact in a batch, the entire run fails without signing anything; previously, signing continued regardless. Certificates whose Key Usage permits neither digital signature nor non-repudiation are also refused. Pass '--warn-wrong-purpose' to warn and sign anyway. Verification reports these conditions as warnings, so existing signatures still verify.
• An unsupported file type now stops a signing run before anything is signed, rather than after part of the batch has already been signed. Use '--continue-on-fail' to sign the rest of the batch, as before.
• 'SignotaurTool' now returns dedicated exit codes for invalid or mutually exclusive arguments, unsuitable certificates, document-signing timestamp failures, invalid input formats and rate-limited requests. It also returns a new code when document signing is not licensed. Existing codes have not been renumbered, but some failures previously returned a different, generic or success code, so check any pipeline that depends on specific codes against the exit code reference.
• The server now identifies the occupied port and returns a dedicated exit code when it cannot start because the website port is already in use.

Infrastructure

• The server now requires .NET Runtime 10.0.10; the installer installs it if it is missing.
• Various third-party package updates.

• Fixed automatic web-certificate renewal failing because the stored AD CS password was not decrypted.
• Fixed certificate issuance failing with an unclear error when the requested validity extended beyond the issuing CA's expiry. The validity is now capped at the issuer's expiry.
• Fixed an AD CS root or intermediate being shown in place of the Internal CA's own on servers using both.
• Fixed overlapping column headers on the certificate tables.
• Fixed renewed certificates not being marked as superseded on My Certificates.
• Reworked several settings and certificate forms to react correctly to edits, fixing cases where the Save button could remain disabled.

• Safer backup restore. 'archive restore' now warns before overwriting the server configuration, database and certificates, and requires confirmation. Unattended restores must pass '--yes'. It also reports clearer errors for corrupt or truncated backups, databases still in use, access-denied paths and master key sealing failures.
• Improved command-line output. 'archive' server command now displays clean, readable output instead of raw log lines. It also supports '--theme' ('General', 'Dark', 'Light' or 'None') and '--no-color'. Use '--theme Light' or the 'NO_COLOR' environment variable for white-background terminals.

• Encrypted backup restore. Passphrase-protected '.sigbak' archives created by the previous release omitted required cryptographic parameters and cannot be restored or verified. After upgrading, create a new backup, verify it with 'archive verify', and discard any backups from the previous release. Live server data and secrets were not affected.

• New Enterprise Features:
  • Enterprise licenses are now available for Signotaur. Purchasing an Enterprise license grants access to new features related to internally and externally managed certificates. Note that every server gets a one-time 90-day grace to set it up and evaluate it without an Enterprise license: you get a single managed web (TLS) certificate, valid for up to 90 days, after which the server reverts to self-signed. Add an Enterprise license to keep that web certificate auto-renewing and to issue and sign with managed code-signing certificates.
  • Internal Certificate Authority: Signotaur can now run its own built-in CA hierarchy (root + intermediate) to issue and manage code-signing and web (TLS) certificates directly. This includes on-demand issuance, automatic renewal and expiry notifications. A managed certificates list tracks current and superseded certificates.
  • External ADCS issuance. Managed certificates can also be issued from a Microsoft Active Directory Certificate Services server, over either the DCOM or Certificate Services (CertSrv) web transport, using enterprise certificate templates.
• New Features:
  • Web (TLS) certificate management. A dedicated admin area for the certificate presented by the server web interface, allowing selection of the source (self-signed, an existing PFX file, the Windows certificate store, or the managed CA), view the live certificate, its chain and expiry, and download the chain anchor (PEM or DER) with instructions for distributing it to client trust stores. Note that using the managed CA as the web-certificate source requires an Enterprise license, but a one-time certificate can be issued with a capped 90-day validity.
  • Encrypted, portable backups. A new archive command (create, restore, verify, extract) produces passphrase-protected .sigbak backup bundles containing the configuration, database, and CA/managed certificates. Restoring a bundle on another machine re-seals secrets under that machine's key, providing a supported migration path. Scheduled backups now emit a full .sigbak archive when a backup passphrase is configured.
  • At-rest secret protection (DPAPI). On Windows, the master encryption key is sealed with a machine-bound DPAPI key, so an off-box copy of the configuration, CA private keys, and other at-rest secrets (VM snapshot, copied disk) cannot be decrypted without a proper restore. OAuth client secrets are now also encrypted at rest.
  • Per-API-key rate limiting. Optional fixed-window rate limiting can be enabled for gRPC signing endpoints, with configurable request counts and window durations per API key (off by default).
• Improvements:
  • Most server settings now take effect immediately, without a service restart -including email, event retention, password policy, session/login expiry, update-check preferences, the PKCS#11 PIN-failure limit, and enabling/disabling rate limiting. Settings that still require a restart (hostname and port, OAuth providers, log-file changes, and changes to an active rate limiter) now clearly indicate so with a restart-pending banner.
  • Configurable login session lifetimes. A login where "Remember me" is left unticked can now be given a shorter idle timeout, separate from the longer remembered-login lifetime, so unattended sessions expire sooner. Administrators can also choose whether sign-ins via external providers (Google, GitHub) stay signed in or last only for the browser session. Both are set under Settings > Options.
  • Concurrent-edit protection across all configuration screens: saving uses optimistic-concurrency tokens, and a conflict dialog shows when another administrator changed the same settings (and who/when) rather than silently overwriting them.
  • Editing settings now warns about unsaved changes before you navigate away, and a pre-save summary lists exactly what will change and when each change takes effect.
  • The installer offers five certificate-configuration modes (existing PFX, Windows certificate store, self-signed, built-in CA, and external AD CS) with dedicated sub-pages, and validates your selections - PFX/store certificates, self-signed generation, AD CS connectivity, and subject names - before letting you continue. The installer also honors the configured backup directory and takes a pre-upgrade backup.
  • The admin web app gained consistent save dialogs, buttons, dirty-change detection, and certificate-table layouts throughout.
• Infrastructure:
  • Updated .NET SDK to v10.0.301.
  • Various third-party package updates.

• Reworked several account and configuration forms to react correctly to edits - fixing cases where a submit button could remain disabled.

• Detached CMS signing is now supported for archive and disk-image formats (.zip, .7z, .tar, .gz, .tgz, .bz2, .xz, .iso, .img, .vhd, .vhdx) via the new --detached and --signature-file <Pattern> options.
• CMS and RDP signing now support ECDSA code-signing certificates in addition to RSA.
• Unsupported file types that are detected to be valid PE images are now automatically signed with Authenticode, including staged .tmp binaries produced by build tools such as InstallShield.
• The server now translates low-level cryptographic provider errors (CSP/CNG/KSP) into clear, actionable messages when signing or loading certificates, instead of surfacing raw error codes.
• PKCS#11 signing now verifies each signature before returning it and automatically retries transient token errors, improving reliability with hardware tokens and HSMs.
• The message shown when an unsupported certificate type is used for signing is now clearer.
• The client now returns more specific exit codes for a wider range of failures - including Win32 file errors, additional CMS/cryptographic errors, and AppX/MSIX packaging errors - and previously unmapped errors now map to dedicated codes rather than a generic failure.

• Fixed misleading authentication error messages during first-user setup and two-factor login, and hardened client-side parsing of server error responses.
• Fixed intermittent ECDSA signature verification failures caused by an ASN.1 integer-encoding error.
• Fixed a PKCS#11 locking issue where signing and certificate-lookup operations on the same token were not serialized, which could cause spurious "user already logged in" errors.
• The SMTP password is no longer cleared when email settings are saved without entering a new password.
• The user-account popup in the store-certificate registration dialog now closes only when its buttons are clicked, rather than on any outside click.
• The Display Name field is now correctly optional during external-login setup, with its form label linked correctly.
• Infrastructure:
  • Updated the .NET SDK to v10.0.301.
  • Third-party package updates.

• Remote Desktop Protocol (.rdp) file signing is now supported, including timestamping and verification.
• The server now returns the certificate chain with each signing certificate, removing the client's dependency on AIA fetching in firewalled or air-gapped environments.
• CMS, NuGet, VSIX and RDP files are now signed in parallel within a batch for faster throughput.
• The --separate-timestamp option is now respected when signing CMS, NuGet, VSIX and RDP files, not just Authenticode files.
• New DSA certificate registrations are now rejected. DSA was withdrawn by NIST FIPS 186-5 and is no longer validated by code-signing runtimes. Existing registered DSA certificates continue to work.
• A warning is now shown when an ECDSA certificate is used with --add-sha1-signature, as Authenticode dual-signing with ECDSA primary signatures is not supported by the Microsoft Trusted Root Program.
• Warnings are now shown when CLI options are passed but have no effect on the specified file types.
• Infrastructure:
  • Updated .NET SDK to v10.0.202.
  • Third-party package updates.

• Fixed the server web UI footer showing "Forbidden" for non-administrator users.

• NuGet package (.nupkg) and Visual Studio extension (.vsix) signing is now supported, including timestamping and comprehensive verification.
• Added CMS/PKCS#7 signing support for .mobileconfig, .mobileprovision, .provisionprofile and other non-Authenticode file types.
• Certificates without a matching private key or Code Signing EKU are now rejected at registration.
• Unsuitable PKCS#11 certificates are shown greyed out with warnings in the certificate selection UI.
• A warning is now displayed when signing MSI files without --description, which can cause a cryptic publisher name in Windows UAC prompts.
• New '--unsupported-file-types' (--uf) option controls how unrecognised file types are handled during signing and verification.
• Infrastructure:
  • Moved ClickOnce/VSTO manifest signing from server to client, reducing the server's reliance on Windows-only native code.
  • General improvements to error handling.
  • Updated .NET SDK to v10.0.201.
  • Third-party package updates.

• Fixed certificate key type and size not showing immediately after registering a new certificate.
• Fixed database warning caused by an unnecessary transaction in API key lookup.

• Added scheduled database backups, configurable via a new Backup settings page.
• Added --renew [DURATION] and --allow-validity-reduction options to the rotate-key command for API key renewal workflows. --renew extends the new API key's expiry instead of inheriting the old key's expiry, with an optional validity duration, while --allow-validity-reduction permits rotation even when the new key would have a shorter validity period than the original.
• Added option to test web configuration post-installation from the installer.
• Added post-expiry reminder interval for certificate expiration notifications. This is configurable via the Notifications settings page and replaces the previous fixed daily post-expiry notification, and defaults to 28 days.
• Added log file retention policy, configurable via the Logging settings page.
• Added Last Used column and auto-revoke date/time hover tooltip to the API Keys table.
• Settings and profile pages now warn before navigating away from unsaved changes.
• Made some UI improvements on settings pages.

• Fixed sorting issue on certificate tables with multiple pages.
• Fixed over-zealous validation on the External Auth settings page.

• Added '--if-expiring-within' option to the rotate-key command to only rotate keys that are approaching expiry within a specified duration (e.g., 7d, 24h, 1w). Added '--ignore-already-rotated-error' option to suppress errors when a key has already been rotated.
• The installer now provides backup options during upgrades, allowing users to choose to back up the database, configuration, and certificates before the upgrade proceeds.
• When a signing request specifies an unsupported algorithm, the server now logs the list of supported algorithms alongside the error, making it easier to diagnose configuration issues.
• Infrastructure
  • Updated third-party dependencies to the latest stable versions.

• New Commands
  • Added new config command with subcommands (init, set, get, show, unset, path) to persist defaults in %USERPROFILE%\.signotaur\config.json. Supported settings include server URL, certificate selectors (thumbprint/label/subject), console theme, output encoding, and allowUntrusted. Command-line arguments override environment variables, which override config file values.
  • Added new rotate-key command to rotate API keys with a configurable overlap period (0–30 days). During overlap, both keys remain valid; the old key is automatically revoked at expiry. This enables planned credential rollover with minimal client disruption. A new ApiKeyRotator role controls who can perform rotations.
  • Added new auth set-key command which securely stores API keys to files with owner-only permissions. This supports reading keys from stdin or via environment variables. Optional server verification ensures the key is valid before storing. The key file can then be used as input to other commands.
  • The rotate-key command supports direct output to CI systems like Continua CI server via the --emit-secret option. Alternatively, the --write-key-file or --write-env-file options can be used to update key files with the new API key atomically.
• Sign Command
  • Added new --api-key-file option that allows the API key to be provided via a file instead of the command line. Supports both plain-text files and dotenv format.
  • Added new --api-key-name option that specifies a custom environment variable name or key when reading from a dotenv file (default: SIGNOTAUR_API_KEY).
  • Added new --fai`l-if-expiring-within option that checks API key expiry before signing and fails if the key expires within the specified duration (e.g., 7d, 24h, 1w). Useful for CI/CD pipelines to catch expiring keys early.
  • The SIGNOTAUR_SERVER environment variable can now be used as a fallback for the server URL when --sign-server is not specified.
  • Added new --label option to select certificates by label. When multiple certificates share the same label, the one with the latest expiry is automatically selected, simplifying certificate renewal workflows.
• Web UI
  • The certificate page in the Admin section has a new Edit Certificate dialog. This allows editing the certificate alias and also assigning a label to the certificate. The label provides a stable logical identifier as an alternative to thumbprints, so expiring certificates can be replaced without updating client configuration.
  • The Users table in the Admin section has a new Manage API Keys dialog. This allows administrators to select users' API keys to revoke. The server now tracks when API keys were created and last used, and these details are shown next to each key. Each user can now be assigned to the ApiKeyRotator role in the Edit User Dialog.
  • All revoked and expired API keys can now be cleaned up on the API Keys page in the user's Profile section of the Web UI.
  • Added name and avatar of current logged-in user to the header.
  • Page sizes for tables with paging can now be set in the configuration file.
• Improvements
  • Certificate selection by subject now chooses the certificate with the latest expiry when multiple certificates match, rather than returning an error.
  • Added short option aliases for all command-line options.
  • Certificate selection logging now shows which selector (thumbprint, label, or subject) was used when multiple were provided. Note selection precedence is: thumbprint > label > subject.
  • Added daily limit to configuration file for API key rotations.
  • Now intercepting more Windows error codes to log friendly error messages on client.
  • Client error output is now cleaner, with stack traces only shown in verbose mode.
  • Improvements to database connections and transactions in multiple threading scenarios.
• Infrastructure
  • Updated the .NET runtime to version 10.0.3.
  • Updated third-party dependencies to the latest stable versions.

• Security Fixes
  • Fixed a vulnerability due to Windows services requiring service paths to be quoted.
  • Added signature verification for client update manifests to prevent tampering by man-in-the-middle attacks.
• Bug Fixes
  • Fixed issue with certificate enabled state not being updated correctly without refreshing the page.
  • Fixed paging issue on admin users table.
  • Fixed issue where avatar was not displayed in admin users table.
  • Fixed issue where debug logging would be displayed in some cases when verbose mode was not enabled.
  • Fixed issue where Create User dialog was not cleared on close.

• The server now sends email notifications to API key owners when keys are approaching expiration or have expired. Notification timing is configurable in server settings.
• Users can now control which types of email notifications they receive (API keys, code signing certificates, website certificates) from their profile settings.
• The command-line client now displays warnings when an API key is approaching expiration, helping prevent authentication failures.
• Added a new --theme option to customize console colours (light/dark/general), along with a --no-color option to disable colored output for CI/CD compatibility.
• Improved robustness when working with PKCS#11 hardware security modules, including automatic recovery from session failures, library re-initialization on errors, and improved thread safety.
• Added new Windows error descriptions, making it easier to diagnose signing failures.
• Infrastructure:
  • Updated the .NET runtime to version 10.0.2.
  • Updated third-party dependencies to the latest stable versions.

• Corrected a problem that prevented notification settings from being saved correctly.
• Fixed an issue where cancelled operations did not return the correct exit codes.