SignServer 5.8 Release Notes

The PrimeKey SignServer team is pleased to announce the release of SignServer 5.8.

This release brings improvements for short-lived certificates when using JSON-based token authentication and enhancements for eIDAS Advanced level signing. With this release, SignServer also supports setting up one-time keys using an EJBCA Peer Connection in RA mode.

Deployment options include SignServer Hardware Appliance and SignServer Cloud.

Highlights

Use Information from JWT Claims in Short-Lived Signing Certificates

Customers using OAuth 2.0 or OpenID Connect in an identity provider (authorization server), integrated with SignServer using the SignServer JSON Web Token JWT Authorizer, can now use information from the JWT tokens in short-lived certificates. SignServer 5.8 supports configuring mapping rules between JWT claims and short-lived certificates, allowing user data from the JWT token to be part of the certificate used for signatures on behalf of the authorized user. For more information, see JWT Authorizer.

EJBCA Peer Connection in RA Mode for One-Time Keys

SignServer now allows you to set up one-time keys using an EJBCA Peer Connection in RA mode. This improves security on the CA side as the connection is initiated from EJBCA to SignServer, and therefore the network setup will not need to accept incoming connections to the CA when using one-time keys in SignServer. For more information, see Peer Systems.

eIDAS Advanced Level Signing Enhancements

SignServer 5.8 brings improvements for managing long-term archiving of signed documents. For eIDAS Advanced level signing using PAdES and XAdES signature formats, SignServer now supports extending the validity of a document with a previous signature. In addition, the AdES signer has been improved to handle larger signature sizes. For more information, see AdES Signer.

Upgrade Information

Review the SignServer Upgrade Notes for important information about this release. For upgrade instructions, see Upgrade SignServer.

SignServer 5.8.0 is included in SignServer Hardware Appliance 3.9.1 and SignServer Cloud 1.10.

Change Log: Resolved Issues

For full details of fixed bugs and implemented features in SignServer 5.8.0.2, refer to our JIRA Issue Tracker.

Issues Resolved in 5.8.0.2