2025 Fourth Quarterly Release - 25.4 Notes

November 2025

Keyfactor is pleased to announce the release of Keyfactor Command 25.4, featuring major new enhancements.

Please refer to Keyfactor Command Upgrading for important information about the upgrade process. For a complete list of the items included in this release, see Release Note Details v25.4. For gateway and CA Connector Client release notes, see:

• CA Connector Client Release Notes
• Keyfactor Cloud Gateway Release Notes
• Keyfactor Windows Enrollment Gateway Release Notes
• Keyfactor AnyCAGateway DCOM Release Notes
• Keyfactor AnyCA Gateway REST Release Notes

Highlights

• Risk Intelligence

  Risk Intelligence is a new Keyfactor product that has been integrated into Keyfactor Command for hosted customers. The Risk Intelligence module provides users of Keyfactor Command with improved visibility, unmatched risk insights, and actionable intelligence about issues that affect PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. operations. It is designed to automatically detect the most serious risks among all certificates managed in Keyfactor Command and provide visibility for easy risk monitoring and remediation, including full integration with Keyfactor Command‘s automation capabilities.

  The Risk Intelligence module integration includes the following highlights in Keyfactor Command which will only be presented with a Risk Intelligence license in a hosted environment, otherwise they will be hidden.

  • A new license for the Risk Intelligence module which is required to access the capabilities in Keyfactor Command.

  • New query parsers on the certificate search page:

    • RiskScore
    • Rule
    • Severity
    • Violation

  • New /Certificate API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. endpoints that allow for managing Risk Intelligence:

    • GET /{id}/Validation

    • POST /{id}/Validation

    • PUT /{id}/Validation

    • DELETE /{id}/Validation/{ruleName}

    • DELETE /{id}/Validation/{ruleName}/{violationName}

  • When licensed, the Certificate Details Validation tab has been replaced by the Risk Intelligence dashboard.

  • The Certificate Details Validation tab has been removed and some details from the tab have been consolidated on the Certificate Details Status tab.

  • New security roles permissions have been added to certificate permissions to control user access to the Risk Intelligence elements in Keyfactor Command.

  • A pre-defined SSL TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are protocols for establishing authenticated and encrypted links between networked computers. Discovery network, Risk Intelligence Hosts, is created upon implementation to hold the list of domain names that the user wishes to be monitored by the CT Log & Host Scan Sync process.

• Management Portal Updates

  The Management Portal has been refreshed with a new collapsible sidebar navigation (replacing the top menu and footer and housing their information). When collapsed, only the icon for a given menu is visible. The portal has updated grid styling for a more modern look and feel.

• Certificate Template Creation for EJBCA

  Certificate templates (certificate profiles and end entity profiles) can now be created directly in Keyfactor Command and automatically published to the connected EJBCA instance.

  Existing templates—whether from Microsoft or EJBCA—can be copied to quickly create new EJBCA templates.

  For both Microsoft and EJBCA, certificate template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. settings as defined in the CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. can now be viewed directly in Keyfactor Command.

  Custom certificate extensions can also be defined in EJBCA through Keyfactor Command to support template creation.

• Certificate Store Applications

  Certificate store containers are now known as applications and are no longer tied to the type of the certificate store; certificate stores of different types may be associated with the same application.

Changes & Improvements

• Application Settings

  • The Allow Deprecated API Calls application setting has been updated such that when it is disabled, requests that include the header X-Keyfactor-Requested-With: APIClient are rejected (403 Forbidden), while if the header is missing or null, GET requests proceed normally but POST/PUT requests are blocked by other middleware and return an error (status depends on that middleware).

• Auditing and Logging

  • SMTP Short for simple mail transfer protocol, SMTP is a protocol for sending email messages between servers. configuration changes now appear in the audit log.
  • A correlation ID has been added to logging for the CA Connector API.

• Certificate Authorities

  • Breadcrumbs have been added to the certificate authority A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. add/edit pages to support navigation back to the previous page.

• Certificate Details, Search and Operations

  • The certificate search grid now includes the certificate Owner Role Name.

  • Four new query fields have been added to certificate search to support the risk intelligence feature. These are based on risk intelligence analysis severity levels. The new query parsers are: RiskScore, Rule, Severity, and Violation.

  • A new query field—Lifespan—has been added to certificate search to support searching for certificates by their total lifetime (not remaining validity). The query comparison value is given in number of days, so the following query would return all certificates that were issued with a lifetime of 30 days or less:

    Lifespan -le "30"

  • The SAN query field now includes the comparison operators is not equal to and does not contain.

  • The Validation tab has been removed from the certificate details. CRL A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their scheduled expiration date and should no longer be trusted. and chain building validation functionality as well as a certificate’s state (for example, active or revoked) is now found on the Status tab. The following two properties that previously made up the Basic Constraints validation test are now on the Content tab: Is CA Certificate and Maximum Number of Intermediate Certificates (the latter of which only appears if the certificate is a CA certificate and has a PathLenConstraint defined). Other validation functionality has moved to the new, optional, Risk Intelligence tab (see above).

  • Support for resolving additional EKUs from their OIDs has been added for display in the certificate details. These EKUs are also returned by GET /Templates Keyfactor API requests. See Extended Key Usages for a full list.

• Certificate Templates

  • Breadcrumbs have been added to the certificate template edit pages to support navigation back to the previous page.

  • The list of certificate templates for enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). is now refreshed from the CAs by a periodic task that runs every five minutes (see Keyfactor Command Service Automated Tasks). The results are cached locally on the SQL Server to reduce CA requests and improve performance. The cache lifetime is 180 minutes by default and can be adjusted through an application setting (see Application Settings: Enrollment Tab). On an upgrade, enrollment remains unavailable until the cache is initially built.

  • For templates where the end entity profile name and the certificate profile name are the same, only the end entity profile name will be used when importing the templates into EJBCA. Any existing templates where the end entity profile name and the certificate profile name are the same (i.e., MyName_MyName) will be collapsed to just the end entity name (i.e., MyName) in Keyfactor Command.

• Dashboard and Reports

  • Doughnut charts on the new dashboard now have scrollable legends when the number of labels to display exceeds the height of the window.

  • Two new line graph widgets have been added to the new Dashboard—Certificates Issued Per Week and Certificates Revoked Per Week. Users can select a certificate collection The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be available in other places in the Management Portal (for example expiration alerts and certain reports). or All Certificates (the global collection).

  • The new dashboard now supports collections with a query containing the user-specific special tokens (%ME%, %ME-AN%, or %ROLES%).

  • The new dashboard now features custom count tiles based on a certificate collection and a query string.

  • For container installations of Keyfactor Command, installation of the Logi dashboard and reports component is disabled by default. If this is not enabled, the legacy dashboard will not be an available; the new dashboard will be shown by default and there will be no option to switch to the legacy dashboard. No reports will be available. Enable this using the Helm chart appConfig > analysis > enabled setting.

  • The Certificates With Weak Keys dashboard widget has been updated to includere newed certificates and includes a new description.

• Enrollment

  • Breaking Change: If a default certificate owner is defined (either at the system-wide level or in the enrollment pattern) and no value is provided in the enrollment request, the default value is automatically applied upon submission. This behavior occurs regardless of whether the enrollment pattern Certificate Owner Role policy is set to Optional, Required, or Hidden. This applies to CSR A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. and PFX A PFX file (personal information exchange format), also known as a PKCS #12 archive, is a single, password-protected certificate archive that contains both the public and matching private key and, optionally, the certificate chain. It is a common format for Windows servers. enrollments both through the Management Portal and with the Keyfactor API.

• Enrollment Patterns

  • The ID of the enrollment pattern is now viewable on the Basic Information tab. This information is useful when making Keyfactor API requests.

  • Breadcrumbs have been added to the enrollment pattern add/edit and system wide settings pages to support navigation back to the previous page.

• Identity Providers

  • Breadcrumbs have been added to the identity providers edit pages to support navigation back to the previous page.

• Installing and Upgrading

  • The Database Upgrade Tool now includes two parameters—update and check. The new check feature allows users to check whether the database needs upgrading before proceeding.

  • Added support for an Offset Seed for Built-in Schedules installation option, allowing interval-based jobs to start at staggered, deterministic offsets instead of all running at once. This spreads recurring workloads over time and helps reduce database load. This is available in the configuration wizard for Windows installs and in the container install values file settings (offsetSeed).

  • The Logi Analytics Platform is now an optional installation component for the Keyfactor Command server.

• Licensing

  • For licensing, a certificate is not counted as actioned under In Collection Workflow or Expiration Alert when the referenced expiration alert’s workflow A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. cannot run (for example, it has no published version or is disabled). The certificate may still be counted as actioned if it meets any other criterion (see Actioned Certificates Tab).
  • For licensing, a certificate is not counted as actioned in any category if it is discovered using SSL Discovery or managed with SSL Monitoring. The certificate may still be counted as actioned if it meets any other criterion (see Actioned Certificates Tab).

• PAM Providers

  • Breadcrumbs have been added to the PAM PAM (Privileged Access Management): Controls privileged access by vaulting credentials, enforcing least-privilege/just-in-time access, rotating secrets, and auditing sessions. Across Keyfactor products, PAM protects diverse sensitive operations and secrets—for example certificate stores and CA credentials—via built-in or third-party providers; external integrations are delivered as custom PAM extensions (several published on Keyfactor’s public GitHub). providers Open Command Secret Provider pages to support navigation back to the previous page.

• Security

  • The ID of the security claim is now viewable on the Claims grid. This information is useful when making Keyfactor API requests.

  • Breadcrumbs have been added to the security roles and claims add/edit pages to support navigation back to the previous page.

• SMTP

  • SMTP in Keyfactor Command can now be configured to use OAuth client ID authentication.
  • SMTP configuration changes are now written to the audit log.

• Keyfactor Universal Orchestrator

  • Client certificate authentication for the orchestrator Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. has been updated such that the /Session/Register endpoint An endpoint is a URL that enables the API to gain access to resources on a server. can be used without presenting a client certificate in order to initially register the orchestrator and acquire a client certificate if the request includes a CSR.

• Workflow and Alerts

  • The workflow types certificate entered store and certificate left store no longer use a subkey of certificate store container due to the change in functionality of applications (formerly containers).

  • The Renew Expired Certificates workflow step now uses the CA value for enrollment based on the following rules:

    • If the CA value is provided, use it.

    • If the CA value is not provided but the enrollment pattern or template is provided, use a valid CA from the provided enrollment pattern or template.

    • If no CA, enrollment pattern, or template is provided, use the CA from the expiring certificate.

  • Support for substitutable Active Directory–based special text tokens (for example, requester:mail or principal:displayname) has been restored in alerts. These tokens, previously removed in version 24.4, are now available again for customers using Active Directory as their identity provider.

  • Enrollment workflows now support an additional substitutable special text token, $(request:sans), which includes the SANs provided in the initial CSR.

Fixes

• Enrollment no longer fails if an invalid email address has been entered in the workflow used for the enrollment. During validation of the workflow, invalid email addresses will be flagged and the workflow will not be allowed to save until the problem is corrected.
• The Reenrollment/1/Configure endpoint in the Orchestrator API now responds with ECC Elliptical curve cryptography (ECC) is a public key encryption technique based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of the traditional method of generation as the product of very large prime numbers. as the KeyType when ECDSA ECDSA (Elliptic Curve Digital Signature Algorithm) is used for digital signatures in public-key cryptography. It offers strong security with smaller key sizes compared to RSA, making it ideal for resource-constrained environments. is the desired key type The key type identifies the type of key to create when creating a symmetric or asymmetric key. It references the signing algorithm and often key size (for example AES-256, RSA-2048, Ed25519). to maintain backwards compatibility.
• A /Session/Register request to KeyfactorAgents now accepts either the string-based or older GUID-based capabilities to support backwards compatibility.
• On edit of a certificate metadata Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. field, the value displayed in the Enrollment Handling column no longer shows as an integer rather than the correct Hidden/Optional/Required value.
• The application setting Display CA Hostname, under Console → General, no longer hides the Host URL field in the certificate authority page basic tab.
• The application setting Display CA Hostname, under Console → General, no longer applies to the Certificate Authority parameter A parameter or argument is a value that is passed into a function in an application. in POST /Enrollment/CSR, POST /Enrollment/PFX, and POST/Enrollment/Renew requests with the Keyfactor API. The CA can be provided with or without the hostname (for example, corpca01.keyexample.com\\CorpIssuingCA1 OR CorpIssuingCA1) regardless of the application setting state as long as the provided value is unique.
• Improved the deployment error shown by POST /Enrollment/PFX and POST /Enrollment/PFX/Deploy when a template that does not retain the private key Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. is used. The message now clearly indicates that deployment failed because no private key is available.
• Deleting a security role that has been added to an enrollment pattern’s Associated Roles list no longer results in a 500 error.
• Workflows no longer lose condition variables or approval signal roles when reverted to an earlier version (for example, reverting to version 2 and publishing it as version 4).

• Clicking a reviewlink from a workflow email that has already been completed, no longer results in an “unexpected error”. If the step has already been approved, the user will receive a message to that affect and be directed to the log for more information. If the step has already been denied, the user will see the approve/deny page and if they submit another response, will receive a message of:

  Only running or suspended instances can receive signals. The current state of instance 'XXX' is 'Rejected'.

Deprecation & Removals

• The license for the Logi Analytics Platform, used by the Keyfactor Command dashboard and reports, will expire on November 28, 2027 and will not be renewed. Customers who have not upgraded to Keyfactor Command 26.1, when the new reports and dashboards will be available, or later by that date will no longer be able to use the dashboard or reports.

Known Issues

• Searches for workflow instances using the InitiatingUserName query parser fail with an “invalid column name” error. This will be corrected in a future release.

• The V1 Reports endpoints (for the legacy (Logi-based) reporting engine) are deprecated and will be removed in November 2027. They remain functional for backwards compatibility only.

• If the Certificate Owner Role is set to Hidden for a non-default enrollment pattern, and that enrollment pattern specifies a default certificate owner that differs from the default enrollment pattern for the same template, the certificate owner applied after enrollment will incorrectly reflect the default enrollment pattern’s certificate owner rather than the one defined in the selected enrollment pattern. This issue will be corrected in a future release.

• Selecting certificate stores of different types and attempting to assign them to a single application results in an error stating that “...different categories cannot be approved in a single batch.” A future release will allow assigning multiple certificate store types to an application in one action.

• The usp_DisassociateCA stored procedure may fail in reference to the dbo.StagingFields table indicating Invalid object name 'dbo.StagingFields'. The workaround to this issue is to edit the stored procedure and comment out the following line (approximately line 63) by adding -- in front if it:

  --DELETE FROM [dbo].[StagingFields] WHERE CertificateAuthorityId = @CAId;

  This issue will be corrected in a future release.

• There is an issue in the new template naming functionality for EJBCA that can accidentally create duplicate templates with the wrong name under certain circumstances. This will be fixed in a future release.

API Endpoint Change Log

Please review the information in the API Change Log for this release carefully if you have implemented any integration using these endpoints: API Change Log v25.4.