PKI Appliance 2.4.0

The PrimeKey Appliance team is proud to announce the release of PKI Appliance 2.4.0.

This is a feature release which introduces several new functionalities and improvements and restructures the appliance portfolio by introducing new models. From this release on PrimeKey will offer the PKI Appliance in three different models (S, M, L) addressing different needs depending on the use cases.

PKI Appliance 2.4.0 Release Notes

Appliance Platform

New Features

• Introduction of new PKI Appliance models S, M, L. See details in the technical specification.
• Option to load FIPS firmware module into the HSM to enforce FIPS Restrictions.
• Support for signed and encrypted firmware and application software packages. All future updates will be signed and encrypted.
• Improved SSH/console password and key handling. WebConfigurator now supports option to set the SSH password or upload an SSH key for authentication. Console access can be enabled and disabled.

Improvements

• Improved RAID status information in WebConfigurator.
• Updated firewall rules.
• Notification for running background jobs. Clearer error messages and explanation of error codes.
• NTPd has been updated to 4.2.8p4.
• Syslog appender format has been adjusted.
• Apache Proxy has been updated to 2.4.16.
• SSHd has been updated to 7.1p1.

Solved Issues

• In the past it could happen that the connection from EJBCA to the HSM could expire after an idle period of a few days. The result was that EJBCA was unavailable as it could not write to the audit log. This problem has been addressed by activating HSM Keep Alive service in EJBCA by default.
• In the case one node of a 2-node cluster has been disconnected, the other might become also unavailable until it is forced-into-primary from Web-Configurator web GUI. Unfortunately EJBCA might remain unavailable after this operation and the only workaround is to restart JBoss application server using the console. This issue has been resolved by an automatic application server restart after forcing the node into primary mode.

Security Patches

• Commons-collections library has been removed as a preventive security measure.

EJBCA and SignServer

This version of the PKI Appliance runs EJBCA Enterprise 6.4.0. For more info view the EJBCA Enterprise 6.4.0 product release.

The optional SignServer add-on for this appliance version, is SignServer Enterprise 3.7.0. For more info view the SignServer Enterprise 3.7.0 product page.

More information

Detailed product sheets and basic information on PrimeKey PKI Appliance is available here.

For further information contact Martin Oczko, Product Manager, PrimeKey Labs GmbH, tel: +49(0)241 608 471 17, e-mail: martin.oczko@primekey.de