Skip to content

Certificate Intelligence — Changelog

Release notes for Blackfort Certificate Intelligence. Newest version first. Versioning follows Semantic Versioning.

Product maturity

Certificate Intelligence is in its pilot / early-access phase. The feature set is growing continuously; feedback from pilot operation feeds directly into upcoming versions.

1.0.0 — 2026-07-01

First publicly documented version of the central, read-only certificate inventory.

Added

  • Central inventory across all sources — the primary key is the SHA-256 fingerprint; re-importing updates existing entries without overwriting curated governance data (upsert).
  • CA connectors for Microsoft ADCS, EJBCA, HashiCorp Vault PKI, smallstep step-ca and Azure Key Vault — as lightweight, read-only exporters using a stable, versioned exchange format.
  • Active discovery: a lightweight built-in TLS scanner (host:port, port ranges) and Certificate Transparency log monitoring per domain with origin classification.
  • Air-gapped operation: file export/import and watched auto-import folders (multi-file upload) for isolated segments without network connectivity.
  • Revocation checking per certificate via CRL and OCSP (good / revoked / unknown), including manual CRL upload for air-gapped environments.
  • Governance layer: owner, critical/important function, active/orphaned, free custom columns and an audit trail per certificate.
  • Compliance reporting with DORA references, expiry escalation by service class, weak cryptography detection, key reuse and orphaned certificates.
  • Chain / trust resolution (AKI/SKI) with intermediate and root certificates as first-class objects.
  • Notifications via a Microsoft Teams daily digest (expiry, weak crypto, orphans, revoked-but-active).
  • Archive/delete certificates to keep the inventory clean without losing evidence.
  • Export to CSV and XLSX from any view.
  • Roles: web login with admin (write) and viewer (read); agents authenticate via API token.
  • Self-service for viewers (optional, can be enabled): users with read access can trigger the revocation check and a CT check themselves; administrative configuration stays hidden from them.