Skip to content

Certificate Intelligence — Changelog

Release notes for Blackfort Certificate Intelligence. Newest version first. Versioning follows Semantic Versioning.

Product maturity

Certificate Intelligence is in its pilot / early-access phase. The feature set is growing continuously; feedback from pilot operation feeds directly into upcoming versions.

1.1.0 — 2026-09-22

Added

  • Signed offline license (Ed25519): the register verifies the license file locally against a built-in trust anchor, with no phoning home and no hardware binding. If it is missing, expired, or cannot be verified, the register switches to read-only mode - reading, evaluations and export remain available, write actions return 403. Warning banner starting 14 days before expiry; status available via GET /api/v1/license.

Documentation

  • Corrected the installation and user guides: delivery as a signed package instead of via a (non-existent) registry, with a checksum and signature for verifying origin. A bundled TLS termination is planned for a future version and is not yet part of the delivery - until then, a reverse proxy of your own is required. The OVA appliance is offered on request, not a ready-made standard artifact.

1.0.0 — 2026-07-01

First publicly documented version of the central, read-only certificate inventory.

Added

  • Central inventory across all sources — the primary key is the SHA-256 fingerprint; re-importing updates existing entries without overwriting curated governance data (upsert).
  • CA connectors for Microsoft ADCS, EJBCA, HashiCorp Vault PKI, smallstep step-ca and Azure Key Vault — as lightweight, read-only exporters using a stable, versioned exchange format.
  • Active discovery: a lightweight built-in TLS scanner (host:port, port ranges) and Certificate Transparency log monitoring per domain with origin classification.
  • Air-gapped operation: file export/import and watched auto-import folders (multi-file upload) for isolated segments without network connectivity.
  • Revocation checking per certificate via CRL and OCSP (good / revoked / unknown), including manual CRL upload for air-gapped environments.
  • Governance layer: owner, critical/important function, active/orphaned, free custom columns and an audit trail per certificate.
  • Compliance reporting with DORA references, expiry escalation by service class, weak cryptography detection, key reuse and orphaned certificates.
  • Chain / trust resolution (AKI/SKI) with intermediate and root certificates as first-class objects.
  • Notifications via a Microsoft Teams daily digest (expiry, weak crypto, orphans, revoked-but-active).
  • Archive/delete certificates to keep the inventory clean without losing evidence.
  • Export to CSV and XLSX from any view.
  • Roles: web login with admin (write) and viewer (read); agents authenticate via API token.
  • Self-service for viewers (optional, can be enabled): users with read access can trigger the revocation check and a CT check themselves; administrative configuration stays hidden from them.