See below for the bugs fixed in Certificate Enrollment Gateway for Cryptographic Security Platform 1.5.0.

Enrollments could fail if the database was not the internal database (CEG-3735, CEG-3733, CEG-3621)

Previously, enrollments could work if the database was the internal database, but may not have worked if the database was an external database or Cryptographic Security Platform PKI DB Appliance. This issue was observed with SCEP, EST, and WSTEP enrollments. If some other protocols such as ACMEv2 were enabled, then enrollments could work with any database. These issues are fixed in this release. 

EST deployment could fail if the truststore was in PEM format (CEG-3651)

When deploying the EST protocol in Certificate Enrollment Gateway, the EST Service requires an SSL certificate to terminate SSL connections coming from EST clients. To validate the EST SSL certificate, Certificate Enrollment Gateway requires a truststore containing the CA certificate chain for the SSL certificate, from the Issuing CA to the root CA. Previously, deploying the EST protocol could fail if the SSL truststore was in PEM format. This issue is fixed in this release.

Certificate extension requests were ignored during EST enrollment (CEG-3648, CEG-3303)

Previously when a certificate was requested using the EST protocol, Certificate Enrollment Gateway ignored additional attributes included in the CSR (such as Subject Alternative Name extensions), and the resulting certificate did not include them. Starting in this release when a certificate is requested using the EST protocol, Certificate Enrollment Gateway now reads the additional attributes included in the CSR and applies them to the issued certificate. With this change, details such as Subject Alternative Names can now be requested directly by the client at enrollment time.