DECEMBER 2022

The SignServer team is pleased to announce the release of SignServer 5.11.1. (SignServer 5.11.0 was an internal release, not generally available for customers).

This release includes a new OS-independent TimeMonitor mechanism and Google Cloud KMS support among other features. Starting with this release, the P11NG crypto token is recommended for all use cases on all platforms. This release also upgrades Bouncy Castle to 1.72.

Deployment options include SignServer Hardware Appliance, SignServer Software Appliance, and SignServer Cloud.

Highlights

OS Independent TimeMonitor

SignServer TimeMonitor is utilized in time-stamping use cases to monitor the difference between the local time and the time of an external NTP server to avoid issuing timestamps if the time difference exceeds a configured value. With SignServer 5.11, SNTP is by default supported natively, enabling using the SignServer TimeMonitor feature without the need for ntpdate and ntpq commands in the operating system. This new mode of operation for TimeMonitor also supports the use of multiple time servers for redundancy. For customers running SignServer on operating systems with the ntpdate and ntpq commands, it is still possible to configure SignServer to use these as per the legacy functionality. For more information, see SignServer TimeMonitor.

Full-featured P11NG as recommended PKCS#11 Crypto Token for new deployments

As of SignServer 5.11, P11NG is the recommended crypto token for new deployments of all use cases on all deployment types. P11NG was first introduced in SignServer 4.3 as an alternative PKCS#11 crypto token for certain functionality not supported by the Java SunPKCS11 provider. The functionality supported by the P11NG provider has evolved over time and now includes key wrapping, EdDSA algorithm support, and various Cloud HSM options. For more information, see the documentation on how to Migrate from SunPKCS11 to P11NG. 

Google Cloud KMS Support

SignServer 5.11 includes support for Google Cloud KMS as HSM, expanding the SignServer Cloud HSM support beyond the previously supported AWS and Azure Cloud HSM options. The support for Google Cloud KMS is based on the use of the P11NG PKCS#11 crypto token.

Keyfactor branded user interface

The Keyfactor branded web user interface is now available per default for all new deployments and all existing deployments upgraded to SignServer 5.11.

Announcements

Deprecation of old WildFly versions

As of SignServer 5.11, the use of WildFly versions 9, 10, and 11 is deprecated.

Deprecation of SignServerWS/ValidationWS

As of SignServer 5.11, the use of SignServerWS/ValidationWS is deprecated. 

Deprecation of XAdESSigner

As of SignServer 5.11, the use of XAdESSigner is deprecated. Use of AdES Signer is recommended for XAdES signatures.

Deprecation of OOXML Signer

As of SignServer 5.11, the use of OOXML Signer is deprecated.

Deprecation of ODF Signer

As of SignServer 5.11, the use of ODF Signer is deprecated.

Deprecation of Certificate Validation Framework

As of SignServer 5.11, the use of Certificate Validation Framework is deprecated.

Deprecation of Crypto Token definition in Signers

As of SignServer 5.11, the use of Crypto Token definitions in Signers is deprecated. Customers with legacy Signer configurations including Crypto Token definitions are advised to separate the Crypto Token configuration into a Crypto Token worker and update the Signer configurations with a reference to the Crypto Token worker.

Upgrade Information

Review the SignServer Upgrade Notes for important information about this release. For upgrade instructions, see Upgrade SignServer.

SignServer 5.11 is included in SignServer Hardware Appliance 3.11, SignServer Software Appliance 2.3, and SignServer Cloud 1.13.

Change Log: Resolved Issues

The following lists fixed bugs and implemented features in SignServer 5.11.

Issues Resolved in 5.11.1

Released December 2022

Bug Fixes

DSS-2533 - Regression: TSA_URL is not working in PDFSigner

DSS-2534 - Regression: Error page about connecting using certificate displayed blank

Issues Resolved in 5.11

Internal Release December 2022

New Features

DSS-825 - Implement internal SNTP client instead of executing the NTP commands in TimeMonitor
DSS-1902 - Support for building on Java 11
DSS-2428 - Add support for specifying RSA public exponent also with P11NG crypto token
DSS-2450 - Add option for MSAuthCode signatures to replace existing signatures
DSS-2469 - Support for running the web tests against a remote SignServer (of any packaging type)
DSS-2478 - GCP KMS PKCS#11 support in SignServer based on P11NG
DSS-2491 - Add support for Ed25519 on Utimaco (HSM custom mode)
DSS-2500 - Add support for SHA384withECDSA and SHA512withECDSA in MRTDSODSigner
DSS-2517 - Rebranded SignServer CE UI theme

Improvements

DSS-1942 - Remove WildFly remoting output from when running AdminCLI
DSS-2289 - Include class name in error message for incorrect time source
DSS-2315 - Update BC deprecated reference
DSS-2383 - Remove worker name from error messages from SODProcessServlet
DSS-2492 - Web UI hardening
DSS-2499 - P11NG-tool uses deprecated "which" command
DSS-2501 - Synchronize default P11 library definitions with EJBCA
DSS-2505 - Add parameter to specify self-signed DN when generating key pair with P11NG-tool
DSS-2507 - Add TRUSTANCHORS property to AdES Signer template
DSS-2508 - Clarify input format for PlainSigner in legacy client-side hashing mode with RSASSA-PKCS1_v1.5
DSS-2511 - Move TimeMonitor Manual into the normal documentation
DSS-2514 - Detection of HSM vendor in P11NG
DSS-2516 - Upgrade BC to 1.72
DSS-2525 - Upgrade dependencies

Bug Fixes

DSS-1681 - Confusing error message with alias selector, noauth and key wrapping
DSS-1811 - SignClient can not be run from directory having a space character in its file name
DSS-1815 - SignDocument Command fails with CLIENTWS & WEBSERVICES protocols if host not specified
DSS-2270 - JWT Authorizer: "Unknown issuer" is incorrectly logged
DSS-2342 - Error 500 when you reload audit log page with empty value for "Displaying results" or "Entries per page"
DSS-2397 - NPE when not specifying signature algorithm and using ECDSA
DSS-2399 - NPE in JwtAuthorizer
DSS-2412- Configuring JwtAuthorizer with public key in PEM format instead of Base64 gives IllegalArgumentException instead of being listed as error
DSS-2455 - Failed key test results rendered as success message instead of failure message
DSS-2483 - EMBED_CRL is in wrong place in the PDF Signer document
DSS-2489 - Transitive dependency on older Bouncy Castle (1.64) not excluded/overridden
DSS-2496 - Can not remove global configuration properties with special characters using delete button
DSS-2503 - P11NG tool fails to generate self-signed cert for ECDSA keypair
DSS-2504 - P11NG-tool gives return code 0 with unknown key algorithm
DSS-2509 - Client HTTP interface relays on platform encoding for data submitted in URL encoded form
DSS-2523 - JArchiveSigner worker template missing in CE