See below for the new features in Certificate Enrollment Gateway for Cryptographic Security Platform 1.5.0.

Support for multiple CA Gateway instances (CEG-3668)

Starting in this release, Certificate Enrollment Gateway now supports multiple CA Gateway instances. Certificate Enrollment Gateway supports up to 20 CA Gateway instances.

As part of this change, the following new configuration settings have been introduced:

• CA Gateway Instance Name specifies a unique name to identify the CA Gateway instance.
• CAGW Keystore Type specifies the format of the CA Gateway Keystore file.
• TLS Protocol specifies the TLS protocol version that Certificate Enrollment Gateway offers to the CA Gateway instance.
• TLS Cipher Suites comma-separated list of TLS cipher suites that Certificate Enrollment Gateway offers to the CA Gateway instance.
• Keystore Provider specifies the keystore provider that Certificate Enrollment Gateway will use to manage keystores.
• Truststore Provider specifies the truststore provider that Certificate Enrollment Gateway will use to manage truststores.
• Also trust the built-in system certificates controls whether Certificate Enrollment Gateway trusts the CA Gateway server if its certificate is signed by the configured truststore or by any of the CAs already trusted by the system (the built-in default trust anchors).
• HTTP Connection Pool Size specifies the maximum number of connections to the CA Gateway instance.
• HTTP Keep-Alive (seconds) specifies the number of seconds to keep a connection to the CA Gateway instance alive before timing out.
• HTTP Retry Count specifies the how many times a failed connection to the CA Gateway instance will be retried before dropping the connection.
• HTTP Retry Interval (seconds) specifies how many seconds to wait after a failed connection attempt to the CA Gateway instance before retrying the connection.
• Bypass Global Proxy for CAGW/PKIaaS Traffic controls whether traffic to the CA Gateway instance bypasses the cluster Global Proxy and uses a proxy server for connecting to the CA Gateway instance.
• Proxy Host specifies the host name or IP address of the proxy server that will be used to connect to the CA Gateway instance.
• Proxy Port specifies the port of the proxy server for connecting to the CA Gateway instance.
• Proxy Username specifies the username used to connect to a proxy server that requires Basic Authentication.
• Proxy Password specifies the password used to connect to a proxy server that requires Basic Authentication.
• Connect to Proxy over HTTPS controls whether Certificate Enrollment Gateway connects to the proxy server over HTTPS instead of HTTP.

The following configuration settings have also been changed:

• CAGW Keystore File (P12) has been renamed to CAGW Keystore File. Certificate Enrollment Gateway has been updated to support JKS and JCEKS formats for the keystore file.
• Trusted CA Certificates File Format has been renamed to Trust Store Type. Certificate Enrollment Gateway has been updated to support JKS and JCEKS formats for the truststore file.
• CAGW Truststore File (P12) has been renamed to CAGW Truststore File. Certificate Enrollment Gateway has been updated to support JKS and JCEKS formats for the truststore file.

Authentication error messages always logged for some successful EST operations (CEG-3729, CEG-3287)

Previously, EST operations that completed successfully could still produced error entries in the audit log. This issue could occur during a request for the certificate request attributes of a profile that did not define any such attributes, and during the first exchange of an operation authenticated with a username and password. This issue could occur because anything that interrupted the normal path of an EST request was recorded in the audit log as a failure, with no distinction between a real problem and an ordinary step of the protocol.

This issue is fixed in this release. Starting in this release:

• Some log messages for an EST operation that were recorded as an error despite being a normal part of the protocol are now logged as information. For example, if an EST client does not send any credentials in the first message (expected with some EST clients), this message is logged as information instead of an error before credentials are requested by the client.
• A failure entry also now identifies the tenant, Certification Authority (CA), and related profile. Previously only a success entry identified this information. 
• A profile without certificate request attributes is now noted in the ordinary product log.

Support for TLS-ALPN-01 validation for ACMEv2 enrollment (CEG-3647)

Starting in this release, ACMEv2 enrollment supports TLS-ALPN-01 validation. To support this validation, the following new ACMEv2 settings have been introduced in this release:

• ACMEv2 TLS-ALPN-01 Port specifies the TCP connection port that the ACMEv2 service uses when performing TLS-ALPN-01 validation. RFC 8737 mandates port 443. Using a different port is intended for testing only.
• ACMEv2 TLS-ALPN-01 Connect Timeout specifies the number of milliseconds to wait when opening the TLS-ALPN-01 validation connection before timing out. The default value is 10000 (10 seconds). The minimum permitted value is 1000. Set to 0 to wait indefinitely (no connect timeout).
• ACMEv2 TLS-ALPN-01 Read Timeout specifies the number of milliseconds to wait during the TLS-ALPN-01 validation handshake before timing out. The default value is 10000 (10 seconds). The minimum permitted value is 3000. Set to 0 to wait indefinitely (no read timeout). 

Reduced permissions for security groups created by InstallEnrollmentService.ps1 (CEG-3617)

For WSTEP enrollment, the InstallEnrollmentService.ps1 script allows you to create, edit, and remove enrollment services in Active Directory. This script can create and assign security groups to these enrollment services. Previously, the security groups created by the InstallEnrollmentService.ps1 script were given the Full Control permission to the enrollment services. Starting in this release, the security groups created by the InstallEnrollmentService.ps1 script are given only the Read permission to the enrollment services.