Release Notes

Keyfactor announces CA Connector The Keyfactor CA Connector is installed in the customer environment to provide a connection between a CA and Keyfactor Command when a direct connection is not possible. It is supported on both Windows and Linux and has versions for Microsoft (Windows only) or EJBCA CAs. Client 26.2, which includes some updates. Only those releases with documentation updates are included in the Release Notes section.

CA Connector Client v26.2 - July 2026

• Update: The Is Ephemeral Keyfactor Command template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. setting allows certificates associated with an ephemeral template to be skipped during a Keyfactor CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. Connector synchronization with the v26.2 CA Connector Client. Pre-26.2 CA Connector Clients will not skip ephemeral certs during synchronization. These certificates will be filtered out on the Keyfactor Command side instead. This does not remove existing certificates from Keyfactor Command. See Certificate Retention.

CA Connector Client v25.5 - March 2026

• Update: The CA Connector Client now requires .NET 10.0.

  Environments running earlier versions of .NET must upgrade before installing or upgrading.

• Update: Helm chart versions now match their corresponding product versions.

  Previously, chart versions used a separate numbering scheme (for example, chart version 1 with product version 25.2), which could cause confusion when selecting versions.

CA Connector Client v25.3 - September 2025

• Update: The log now includes a correlation ID that helps to identify log messages that originated from the same request. The correlation ID is a system-generated GUID that often appears just after the date in the log entry and is the same for all log messages for the given request until the request completes.

• A new log filter has been added to remove multiple assembly loading messages at Trace level that are often not helpful for troubleshooting. The filter is:

  <when condition="starts-with('${logger}', 'Keyfactor.ServiceCollection.Extensions') and level &lt; LogLevel.Error" action="Ignore"/>

• Fix: Slow response from Keyfactor Command on CA synchronization no longer causes the connector to throttle requests to the point where retries are unreasonably infrequent.

CA Connector Client v25.2.1 - July 2025

• Update: The CA Connector Client now includes retry logic to resubmit result data if the following errors are encountered:

  The SSL connection could not be established, see inner exception. (80131620)
  A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

  This is in addition to pre-existing retry logic for other scenarios such as receiving a 503 Service Unavailable from the server.

CA Connector Client v25.2 - June 2025

• Update: The CA Connector Client now supports installation in container. Instructions are provided for Docker, Kubernetes without Helm and Kubernetes with Helm. Containerized CA Connector Client supports HTTPS CAs only.
• Fix: For Linux installs, when a destination is not specified, the logs directory is now created in the correct location (/opt/keyfactor/ca-connector/logs).

CA Connector Client v25.1 - March 2025

• Update: The default installation path for Linux installs has changed to:

  /opt/keyfactor/ca-connector

CA Connector Client v24.4 - November 2024

• Update: An appsetting.json parameter A parameter or argument is a value that is passed into a function in an application. has been added to specify which transport protocol (WebSockets or LongPolling) should be used for the communication between the CA Connector Client and the CA Connector API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. on the Keyfactor Command server (see Appsettings.json File).
• Update: A CAConfigCacheExpirationMinutes parameter has been added to specify the number of minutes that the CA configuration will be cached before being cleared.

CA Connector Client v12.3 - August 2024

• Update: The install now does a connectivity test to Keyfactor Command and the OAuth identity provider before beginning the install to confirm a connection to both. If the connection to either fails, including SSL TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are protocols for establishing authenticated and encrypted links between networked computers. connectivity issues, the install will be terminated. Some connection states result in a warning and the installation will continue. For example, a warning will appear if no CA connector record matching the name of the CA Connector Client being installed is found in Keyfactor Command (see Preparing).
• Update: A NoValidate parameter has been added to skip the connectivity test to Keyfactor Command and the OAuth identity provider.

CA Connector Client v12.0 - June 2024

• Highlight: The connector client has been updated to communicate directly with Keyfactor Command rather than via the remote CA service and configuration that was previously done in the Remote CA Configuration Portal is now done in the Keyfactor Command Management Portal.

• Update: The connector client uses OAuth token authentication to authenticate to Keyfactor Command.

• Update: The connector client uses RabbitMQ to manage communications between the CA Connector Client and Keyfactor Command.

• Update: The connector client now requires .NET 8.

• Update: A script has been added to support changing connector client secrets (see Change Service Account Passwords).

• Update: An Audience parameter has been added to support token authentication.

Remote CA Gateway Connector v24.1 - February 2024

• Update: The connector now requires .NET 6.

Remote CA Gateway Connector v22.1 - August 2022

• Initial release.