Release Notes¶

MazeVault Platform Version History

Document Version: 1.0.60 Last Updated: 2026-08-09

Version 1.0.60¶

Release Date: 2026-07-20

New Features¶

Token Management — External API Tokens with Mandatory Expiry Tracking and Agent Deployment — A new Enterprise function (PoC or Enterprise license, feature token_management) for managing externally-issued API tokens — for example Jira or Signi tokens — that can only be renewed manually in the source system's own UI. Each token is stored with a mandatory expiration date and an optional per-token alert lead time (default 30 days); MazeVault raises a token_expiry incident through the existing notification channels (email, webhook, Teams, Slack, Jira, SMSEagle) before the token lapses, and escalates it to critical once expired. Token values are encrypted at rest (AES-256-GCM) in standard mode, or offloaded to the configured external secrets manager (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault) in Orchestrator Mode. A token can optionally be bound to a project and deployed to the same target types as secrets, reusing MazeVault's shared value-delivery executors: an agent-managed server configuration file (JSON/YAML/ENV key→value, with an optional allowlisted post-install command), a Kubernetes secret, an Azure Key Vault secret, or an AWS Secrets Manager secret (Windows registry / IIS targets are intentionally deferred). A manual renew action records the newly obtained value and its new expiry, resolves the open expiry incident, and re-deploys any targets flagged for sync-on-renewal. Token Management is deliberately separate from Project Key management (project secrets) and Organization System Keys (MazeVault infrastructure keys), and appears under a new Enterprise Functions navigation group. Access is governed by new token:read / token:write / token:delete / token:admin permissions — deployment and renewal require token:write (admin implies it), and revealing a stored token value requires token:admin. The feature is fully manageable through the new mazevault_token Terraform resource and mazevault_tokens data source.
Upgrade Impact (Token Management) — Adds two idempotent migrations: 000193_token_management (creates managed_tokens and token_deployment_targets, seeds token:* RBAC permissions onto existing roles — org_admin full; operator read/write/delete; user and auditor read-only) and 000194_token_target_types (generalizes token_deployment_targets with target_type / integration_id / config so token delivery reuses the shared secret/certificate executors). There are no new environment variables, Helm values, or release-package format changes — the feature reuses the existing encryption, secret-offload, notification/incident, rotation-step delivery, and license infrastructure. The database health check now validates the two new tables. The Terraform provider gains the additive mazevault_token resource and mazevault_tokens data source; no existing resource, data source, API endpoint, or Go SDK contract is changed or removed. The endpoints are gated by the token_management license feature (PoC and Enterprise); without it the /api/v1/tokens API returns HTTP 403 and the UI shows an upgrade banner.

Improvements¶

Admin Batch Triage on Dedicated Rotation and Synchronization Problem Pages — System administrators can now select individual rows or all currently visible rows on Rotation Problems and in each section of Synchronization Problems. The frontend deliberately replays the existing audited single-item actions with at most three requests in flight, reports progress and partial failures, and refreshes the affected problem lists after completion; no unaudited bulk mutation path is introduced. Rotation failures are acknowledged and their linked open incident is resolved when available. Synchronization failures and blocked-seed incidents are acknowledged in their own sections, while pending synchronization conflicts can only be batch-ignored, which changes local conflict status without writing either value to an external provider. “All visible” is intentionally page-bounded and every confirmation states the exact affected count. Individual remediation remains available to non-admin operators with the existing write permissions; batch controls are shown only to the system administrator.
HashiCorp Vault Transit HSM/KMS Backend — mazevault_hsm_device now supports provider_type = hashicorp_vault, backed by the HashiCorp Vault Transit secrets engine. Previously the value was accepted by validation but instantiation failed with unsupported HSM provider: hashicorp_vault because no implementation existed. Vault Transit keys are generated and held by Vault (RSA-2048/3072/4096, ECDSA P-256/P-384/P-521); signing is performed remotely via the Transit sign endpoint so private key material never leaves Vault. The device connectivity test, key listing, public-key retrieval, remote signing (used by internal CA signing and other HSM-routed operations), and key deletion are all implemented. Configuration takes vault_url, token, and an optional mount_path (default transit). Key-encryption-key (KEK) wrapping remains served by the separate system HSM interface and is out of scope for this provider.
Provider-Aware Certificate Templates for External Commercial CAs — The certificate template form now adapts to the capabilities of the selected issuing CA account's provider instead of showing one fixed field set for every authority. Each external CA has a different API and issuance model, so the form is driven by provider-declared capabilities (exposed on GET /ca-providers/{type}/schema): providers with a product catalog (SSLMarket, DigiCert) present the certificate product as a dropdown from the CA's synced product list — the certificate type is derived from the selected product and the free-text external-template OID is hidden; providers that require domain control validation expose a per-template Domain Validation Method (email / dns / file), stored on the template as dcv_method (migration 000191); ACME issuers continue to show the ACME challenge policy; internal CAs show neither. The SSLMarket provider now resolves the product code from the template's linked CA product (falling back to a free-text code and then the account default) and honors the per-template domain validation method; DigiCert likewise prefers the per-template method. A new optional dcv_method argument is available on the mazevault_certificate_template Terraform resource. Existing templates are unaffected: the new column is nullable and empty means "use the provider/account default".

Bug Fixes¶

Terraform Managed Tokens Now Have a Valid, State-Safe Lifecycle — The mazevault_token resource used the reserved root attribute name provider, causing Terraform schema validation to reject the resource. The label is now exposed as token_provider, with a versioned state upgrader that preserves existing state values. Token reads and deletes now treat HTTP 404 as resource absence while preserving state on authorization, transport, and server failures. Empty description / project_id responses no longer leave stale non-empty state. New tokens can use Terraform 1.11+ value_wo with value_wo_version, so plaintext is absent from plan and state; legacy value remains supported but is explicitly documented as stateful. Import now supports metadata-only management. Migrating an existing resource from value to value_wo is intentionally not automatic because replacement changes the token ID and cascade-deletes its deployment targets.
Rotation Failure Triage Shows the True Open Total with a Rolling Ten-Item Queue — The Overview widget previously displayed the number of incidents in the API's default 20-row page as if it were the total, so tenants with more than 20 open rotation failures always saw an incorrect count. The widget now uses the existing paginated incident response's authoritative total, requests only the ten newest unresolved rotation-failure incidents for display, and reloads the first page after each individual close so the next unresolved incident immediately fills the queue. The misleading page-local High/Critical badge has been removed. Overview intentionally remains an individual-triage surface with no selection or batch-close action.
Secrets Dashboard "Missing in PROD" Metric Now Correctly Reflects Cross-Environment Parity — The Secrets Dashboard KPI previously labeled Missing in PROD never inspected production environments or the is_production organization setting. It counts secret keys that exist in at least one active (comparison-enabled) environment but are missing in another active environment — a cross-environment parity signal that requires at least two active environments. On instances with no production environment (for example a test tenant with only development, integration, migration, and testing), this produced a confusing non-zero "Missing in PROD" count. The card is now labeled Missing (Cross-Env) on both the Secrets Dashboard overview and the Reports view, matching the existing Missing Secrets (Cross-Environment) table below it. The underlying cross-environment computation is unchanged — only the misleading naming and label were corrected.
Orchestrator Mode Key Custody Events Persist Reliably — In Orchestrator Mode, offloading a private key (for example a certificate key sent to Azure Key Vault) recorded a custody audit event whose metadata value was an empty string. Because key_custody_events.metadata is a PostgreSQL JSONB column, the insert failed with invalid input syntax for type json (SQLSTATE 22P02) and the custody entry was lost — logged only as a warning — even though the key offload itself succeeded. Custody events now always persist syntactically valid JSON: an unset or blank metadata value is normalized to an empty JSON object ({}) at the write boundary, so every key offload, retrieval, and deletion produces a durable custody audit record. Callers that already supply structured metadata are unaffected. The database health check now also validates the key_custody_events columns.
SSLMarket Certificate Issuance Corrected to the Live SSLmarket API — Issuing a certificate through an SSLMarket CA account failed with API request failed with status 400: {"error":["No route found"]} on both standard and Orchestrator Mode instances. The SSLMarket provider had been implemented against a REST shape that does not match the published SSLmarket API. The provider now targets the real endpoints and payloads: orders are submitted to POST /order/certificate/{product_code} with the flat order body (domain, SANs, years, CSR, the mandatory dv_auth_method, and owner/authorized-contact/technical-contact/invoice fields that fall back to the SSLmarket account defaults when not configured); order detail, certificate download (by order id and format), domain-control-validation tokens, and revocation now use the correct routes; product resolution reads the real {"products":[…]} catalog; and responses are parsed with the API's actual JSON shapes (string identifiers, array dns_names, and the paid/requested order states). Authentication (X-Auth-Token) and the base URL were already correct and are unchanged. Certificate issuance and the asynchronous external-CA order poller now complete against SSLMarket.
Orchestrator & Sync Secret-Push Audit Events No Longer Fail with a Foreign-Key Violation — In Orchestrator Mode, pushing a secret to an external provider (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault) recorded a SECRET_PUSH_CREATE / SECRET_PUSH_UPDATE audit event whose user_id was mistakenly set to the project's ID instead of a user. Because audit_events.user_id has a foreign key to users(id), the insert failed with violates foreign key constraint "audit_events_user_id_fkey" (SQLSTATE 23503) and the audit record was lost even though the external push itself succeeded — so the external secret diverged from the audit trail. Secret-push and sync-seed audit events are now attributed to the initiating user (and, for system-initiated syncs, to the resolved system actor), so they persist correctly. As defense-in-depth, the audit writer now also guarantees durability: if any audit event ever fails to persist because of a bad actor reference, it is retried once with a null (unattributable) actor rather than dropped; only if the database is entirely unreachable is the full event emitted to the central structured log as a last resort. The previous local emergency-log file sink (/var/log/mazevault/emergency_audit.log), which was unusable on read-only container filesystems in Kubernetes, has been removed. A new mazevault_audit_persist_failures_total metric makes any last-resort emission alertable.
Merkle Integrity Cache Now Tracks Secret Changes — The incremental Merkle integrity cache recognized only the certificate/keytab event vocabulary (create / update / delete) and silently ignored the secret service's past-tense events (created / updated / deleted), logging merkle cache updater: unknown event type and leaving the secret integrity cache stale after every secret change. The cache updater now accepts both forms, so secret create/update/delete operations correctly update the Merkle integrity tree.
Rotation Backups Are Now Encrypted and Support Automatic Rollback — The rotation orchestrator was started without its encryptor wired in, so pre-rotation backups degraded to non-restorable version references and logged rotation backup requested but encryptor not configured — rollback will be limited. Automatic rollback of a failed rotation was therefore unavailable. The orchestrator now receives the system encryptor at startup, so the pre-rotation state is captured as an encrypted backup and automatic rollback is restored. Backups for external names_only secrets continue to rely on the external provider's own version history, as before.
Entra ID Integrations Accept AKS Workload-Identity Background Authentication — Configuring an Entra ID integration (used for app-registration secret rotation and Microsoft Graph sync) with background_auth_method=workload_identity was rejected with unsupported background_auth_method, even though the Microsoft Graph client and the shared Azure credential factory already support AKS federated workload identity. Three separate validation gates — integration create/update, test-connection, and the runtime consistency check used by rotation — defaulted to rejecting the value, so the integration could not be created or, if forced, failed later during rotation with configuration is inconsistent. All three gates now accept workload_identity, which — like managed_identity — requires no static credentials in the integration config: on a workload-identity cluster the runtime performs the federated token exchange for the configured (or webhook-injected) managed-identity client ID. This unblocks Entra credential rotation on AKS workload-identity clusters without a dedicated client-secret app registration.
Spring Actuator Refresh Rotation Step No Longer Crashes on Malformed Configuration — The spring_actuator post-rotation step used unchecked type assertions on actuator_url and on entries of the optional endpoints list, so a wrong config key (for example url instead of actuator_url) or a non-string endpoint caused a worker panic instead of a clear error. The step now validates its input defensively and returns a structured error, and it builds the refresh URL safely so a base URL, a trailing slash, or a URL that already ends in /actuator or /actuator/refresh never produces a doubled path.
Post-Rotation Secret Delivery to Key Vault and Other Targets Now Receives the Rotated Value — Post-rotation delivery actions (Azure Key Vault push, AWS/GCP/OCI secret managers, DevOps variables) require the freshly rotated secret value, but the post-rotation action phase rebuilt an execution context that omitted it, so a delivery action logged new_password not found in input context and silently skipped the write. The rotated value is deliberately never persisted, so it is now resolved at execution time from the just-updated MazeVault secret — identically whether the action runs on the primary or is delegated to a gateway (the value is fetched by the executing runtime and is never carried in the gateway task payload). Delivery for Entra credential rotations continues to flow through the dedicated seeded delivery workflow. As a hardening measure, the previous Key Vault value captured for rollback is now redacted from the persisted post-action record so no secret material is written to the rotation history.
Azure Managed HSM / Key Vault HSM Devices Can Now Be Tested and Used — Instantiating an azure_managed_hsm HSM/KMS device — for the device connectivity test as well as any CA signing, key offload, key rotation, or secret encryption routed through it — failed with CredentialFactory is required for AzureKVProvider because the HSM device service constructed the Azure provider without a credential factory. The Azure credential factory is now injected into the HSM device service and threaded through the provider factory, so Azure Managed HSM devices initialize with a real Azure credential.
Manual Secret-Manager Integration Sync No Longer Rejects Non-Canonical Type Values — Triggering a manual synchronization on a secret-manager integration could fail with sync not supported for integration type: secret-manager when the integration's stored type used a hyphen instead of the canonical underscore form. Integration types are now canonicalized (lowercased, trimmed, hyphens folded to underscores) when an integration is created, and the manual-sync guard compares against the canonical form, so secret-manager and secret_manager are treated identically. Migration 000192 normalizes any existing non-canonical project_integrations.type values so exact-match checks (manual sync, sync rules, key offload) stay consistent.
Pull/Bidirectional Sync Rules Require a Target Environment Up Front — Creating a pull or bidirectional sync rule without a target_environment was accepted but later failed at execution deep in the environment canonicalizer with environment slug is empty. Sync-rule creation now requires and canonicalizes target_environment for any rule that is not a pure push (push rules derive the environment from the source secret), returning a clear validation error instead of a confusing runtime failure.
ACME Certificate Issuance Now Completes Finalization (Let's Encrypt / ACME CAs) — A v1.0.59 report described ACME issuance passing dns-01 validation but failing at finalize with the error POST-as-GET requests must have an empty payload / must have a nil body, and this was reproduced end-to-end against a local Pebble server. Two defects were found and fixed. First, MazeVault submitted the CSR to the order URL (order.URI) instead of the order's dedicated finalize URL (order.FinalizeURL); because the order URL is a read-only POST-as-GET resource, posting the CSR body there was rejected by the CA. Second, once the CSR reached the correct finalize endpoint, some RFC 8555-compliant servers (including Pebble) do not return a Location header on the finalize response, so the underlying ACME client's internal post-finalize order poll targeted an empty URL and failed even though the CSR had been accepted; issuance now recovers by polling the known order URL and fetching the issued certificate. End-to-end dns-01 issuance through finalize is verified by a Pebble-backed reproduction test (build tag acme_pebble).
Upgrade Impact — Version 1.0.60 is a naming and label correction with no database migrations, environment variables, Helm values, or release package format changes. In the dashboard secrets overview endpoint (GET /api/v1/dashboard/secrets/overview) the response field missing_in_prod is renamed to missing_cross_env. This is an internal dashboard field consumed only by the MazeVault frontend; it is not part of the Go SDK or the Terraform provider, so no integration contract is affected. The cross-environment parity logic and the missing-secrets listing are functionally unchanged.
Upgrade Impact (Orchestrator custody & SSLMarket) — The Orchestrator Mode key custody persistence fix and the SSLMarket provider correction are backend-only changes with no database migrations, environment variables, Helm values, or release package format changes. To issue through SSLMarket, the CA account integration must set the correct product_code (an SSLmarket account may offer products — such as trial certificates — that are not returned by the API product catalog and therefore must be configured explicitly) and, when the account has no default business data, the owner/contact/invoice settings required by the chosen product. dv_auth_method defaults to Email when not configured.
Upgrade Impact (Provider-aware templates) — The provider-aware certificate template feature adds one nullable column via migration 000191 (certificate_templates.dcv_method) and one runtime-computed field (template_form) on the GET /ca-providers/{type}/schema response; both are additive and backward compatible. No environment variables, Helm values, or release package format changes. The mazevault_certificate_template Terraform resource gains an optional dcv_method argument; existing configurations continue to work unchanged.
Upgrade Impact (Audit, Merkle & Rotation) — The secret-push audit attribution fix, the audit durability hardening, the Merkle integrity cache fix, and the rotation backup encryption fix are backend-only reliability changes with no database migrations, environment variables, Helm values, or release package format changes. One additive Prometheus counter, mazevault_audit_persist_failures_total, is exposed; no existing metric, API endpoint, Go SDK, or Terraform provider contract changes. The local /var/log/mazevault/emergency_audit.log fallback is removed in favor of the central structured log, so the last-resort audit sink now works on read-only container filesystems.
Upgrade Impact (Entra WI, Rotation Delivery, HSM & Sync Validation) — These fixes add one idempotent data migration, 000192_canonicalize_integration_type, which normalizes existing project_integrations.type values to their canonical lowercase-underscore form; it is data-only and backward compatible. There are no new environment variables, Helm values, or release package format changes. background_auth_method=workload_identity is now an accepted value for Entra integrations (including via the mazevault_integration API surface), and pull/bidirectional sync rules now require target_environment at creation time. No existing API endpoint, Go SDK, or Terraform provider contract is removed or renamed.
Upgrade Impact (Vault HSM & ACME finalize) — The HashiCorp Vault Transit HSM provider and the ACME finalize fix are backend-only with no database migrations, environment variables, Helm values, or release package format changes. The hashicorp_vault HSM device provider is additive; no existing HSM device configuration changes. The ACME finalize fix corrects the certificate issuance flow only; no API endpoint, Go SDK, or Terraform provider schema is added, removed, or renamed. The Pebble reproduction test is gated behind the acme_pebble build tag and does not run in normal CI.
Upgrade Impact (Problem Triage UX) — The truthful Rotation Failure Triage total and the administrator batch workflows are frontend-only changes. They reuse the existing incident pagination metadata and existing single-item mutation endpoints, permissions, and audit events. There are no database migrations, API or Swagger contract changes, new RBAC permissions, environment variables, Helm values, release-package changes, Go SDK changes, or Terraform provider changes.

Security & Dependency Updates¶

Trivy CRITICAL/HIGH Dependency Vulnerabilities Cleared Across All Modules — The dev-pipeline Trivy filesystem scan (CRITICAL,HIGH, --ignore-unfixed) was failing on fixed-but-outdated dependencies. All affected packages were upgraded to their fixed versions and verified with go build, go vet, module unit tests, and govulncheck (0 reachable vulnerabilities), plus a frontend build and the full Vitest suite:
- Go — golang.org/x/text 0.37.0 → 0.39.0 (CVE-2026-56852 / GO-2026-5970, norm.Iter infinite loop) in backend, cli, k8s-operator, and terraform-provider-mazevault.
- Go — google.golang.org/grpc 1.79.3 / 1.80.0 → 1.82.1 (GHSA-hrxh-6v49-42gf / GO-2026-6061, xDS RBAC and HTTP/2 transport) in backend and terraform-provider-mazevault.
- Go — software.sslmate.com/src/go-pkcs12 0.7.0 → 0.7.2 (GO-2026-5052) in backend and agent; this reachable vulnerability was surfaced by govulncheck even though Trivy's severity filter did not report it.
- Frontend — axios 1.16.0 → 1.19.0 (GHSA-gcfj-64vw-6mp9 and related advisories).
React Router Upgraded to v8 (Major) — The frontend was migrated from react-router-dom 7.17.0 to react-router 8.3.0, which resolves CVE-2026-55685 and GHSA-qwww-vcr4-c8h2. React Router v8 removes the separate react-router-dom package; all imports were moved to react-router (the app is a declarative SPA using BrowserRouter, so no react-router/dom entry point is required). react and react-dom were raised to a minimum of 19.2.7.
Upgrade Impact (Security & Dependencies) — These are dependency and build-time changes only: no database migrations, environment variables, Helm values, or release-package format changes, and no API, Go SDK, or Terraform provider contract changes. The frontend build now requires Node ≥ 22.22 (declared via a new engines field in frontend/package.json); the CI frontend jobs and the frontend Docker image already run on Node 24. The React Router v8 upgrade is a frontend-internal migration with no change to application routes or behavior; the full frontend unit-test suite passes unchanged.

Version 1.0.59¶

Release Date: 2026-07-18

Improvements¶

Secret Rotation Views Refresh Silently After Background Completion — The Secrets tab now uses the existing per-secret rotation status poller as an event detector. When a background secret rotation reaches a terminal state, MazeVault refreshes only the affected secret through GET /api/v1/secrets/{id} and updates the visible version counter without reloading the whole secrets table. If the Version History or Rotation Configuration modal is already open for that secret, the modal reloads its version list or execution history in place. No extra global polling, toast, highlight, or full-page refresh is introduced.
Dedicated Access Control for Synchronization Problem Remediation — Synchronization problems now use a dedicated sync:read / sync:write permission boundary instead of implicitly tying action buttons to project:write. The project_admin, certificate_manager, and secret_manager roles can actively remediate synchronization problems, while auditor and regular users remain read-only. Navigation and the Synchronization Problems page now reflect the user's actual sync permissions.
Sync Failure and Blocked Seed Actions Are Available Directly from the Problem View — The global Synchronization Problems page and the project-level sync conflicts tab now provide confirmed actions for retry, conflict ignore, current sync failure fingerprint acknowledgement, and sync_seed_blocked incident acknowledgement. The left navigation badge now uses the aggregate sync_problem_count, covering conflicts, current sync failures, and blocked seed incidents.
Synchronization Problem Dismissals Scale with One Batched Lookup — The sync failure listing now evaluates acknowledged current-failure fingerprints with a single batched dismissal query instead of one lookup per failed sync rule. This preserves the existing rule/timestamp/error fingerprint semantics and soft-delete behavior while keeping the Synchronization Problems view responsive as the number of failed rules grows.
Certificate Exports Include the Issuer CA Chain More Reliably — Certificate export now normalizes stored certificate bundles and, when needed, resolves the issuing internal CA hierarchy through parent CA records. PEM/CRT and PKCS#7 exports include the leaf certificate followed by the issuer chain, while DER remains leaf-only as before.
Certificate Renewal Readiness Understands Internal CA Accounts — Renewal eligibility, rotation preflight, and rotation resource metadata now resolve internal organization CA accounts through their backing CertificateAuthority. Internal CA-backed renewals report both the CA account and the underlying signing CA, matching the runtime renewal path.
External CA Domain Validation Is Now Visible and Durable — External CA orders from DigiCert and SSLMarket now expose DCV instructions through registered renewal queue DCV endpoints and the project certificate table. Certificates with pending domain validation show a View Domain Validation action that opens the existing DCV status panel, where operators can inspect DNS/HTTP/email validation details and trigger provider re-checks without leaving the certificate workflow.
New External CA Certificate Requests Can Wait for Provider Validation — Certificate requests issued through an external CA no longer assume that SignCSR returns a certificate immediately. If the provider returns an order ID without PEM, MazeVault stores a pending certificate placeholder, links it to the request, records a durable submitted_to_ca queue item, and lets the external CA order poller complete the request when the provider later makes the certificate available.
CA Account Provider Settings Are Persisted and Terraform-Manageable — CA account create/update/sync flows now preserve non-secret provider settings such as DigiCert organization_id, server_platform_id, dcv_method, certificate_dcv_scope, custom base_url, and SSLMarket defaults in account metadata. The Terraform mazevault_ca_account resource adds a settings map for those non-secret values while keeping API keys and ACME EAB material in write-only credentials.
Terraform Secrets Support Write-Only Values for Ephemeral Passwords — The mazevault_secret resource now supports value_wo and value_wo_version for Terraform 1.11+ write-only inputs. Operators can generate a password with an ephemeral Terraform resource such as ephemeral "random_password" and pass it to MazeVault without storing the plaintext in Terraform plan or state. value_wo_version is the stored resend trigger: increment it when Terraform should send a new write-only value. The legacy value argument remains supported for existing configurations, and server-side generate remains available for MazeVault-generated secrets.
Secret Update API and Go SDK Support Metadata-Only Updates — PUT /api/v1/secrets/{id} now treats value as optional: omitting it updates metadata and TTL only, while supplying a non-empty value continues to create a new secret version. The Go SDK preserves the existing UpdateSecret(id, value, ...) method and adds a request-based update path that can intentionally omit value, which the Terraform provider uses for write-only secret lifecycle management.

Bug Fixes¶

Synchronization Problems No Longer Lack Action Icons for Authorized Roles — Users who could see problems through sync:read previously often had no way to resolve them because mutations were bound to project:write. The new sync failure and blocked seed acknowledgement endpoints are protected by sync:write, audited, and intentionally limited to the synchronization problem surface.
Ignoring a Sync Conflict No Longer Requires an External Provider Write — The ignore resolution now closes the local sync_conflicts row with status ignored and does not write to the target secret manager. This allows operators to permanently defer a known conflict without risking an unintended external value change.
Sync Failure Acknowledgement Applies Only to the Current Failure — Sync failures derived from sync_rules.last_sync_status are dismissed by a fingerprint composed from the rule, last sync timestamp, and error. If a later run fails differently, the problem appears again; acknowledgement therefore does not hide new or changed failures.
Rotation Configuration Edit No Longer Shows a Spurious Partial-Load Warning — The secret rotation configuration modal now addresses rotation history and readiness by the canonical rotation resource id (rotation_configs.id / resource.resource_id) instead of the secret id. This fixes the misleading "Some rotation sections could not be loaded. Available data is shown." warning when opening Secrets → Rotations → Edit for a configured secret.
Secret Version Rollback Works Reliably for Existing Version History — Secret rollback now stores archived version rows with a generated primary key, preserves the original version timestamp instead of stamping the archive time, and updates rollback metadata through the model serializer path. The frontend also surfaces backend rollback message / error details as an error notification instead of replacing them with a generic "Rollback Failed" response.
Legacy Secret Version Rows with Missing UUIDs Are Repaired — Migration 000189_fix_secret_version_null_uuid assigns valid UUIDs to legacy secret_versions rows that had missing or zero IDs, and the SecretVersion model now generates an ID before insert when one is absent. This prevents primary-key collisions and rollback failures on environments that already contain affected history rows.
Manual Secret Rotation No Longer Creates Duplicate Local Versions in Staging — The pre_rotation_sync step now compares the external value with the current local secret value before writing a local update. If the values are identical, the step records the pulled value for downstream rotation context without bumping the secret version. This eliminates the staging symptom where one manual rotation produced two new versions and a confusing intermediate system version.
Version History Now Shows the Correct Author for the Current Version — The current (active) version row in the Version History modal was displaying the original creator of the secret instead of the actor who last changed it. The service layer now derives the current-version author from the most recent archived history row, which carries the actor of the last update, exactly as all other history rows do. Automated rotations triggered by the scheduler continue to appear as System; manual triggers show the user who initiated the rotation.
Certificate Chain Fields No Longer Duplicate the Leaf Certificate — Issuance, import, renewal, ACME completion, and external CA order completion now normalize certificate PEM data at the write boundary. CertificatePEM remains the current certificate, ChainPEM stores issuer certificates only, and PublicChainPEM stores the full leaf-plus-chain bundle. Existing contaminated chain data is defensively normalized during export.
ACME Issuance Stores Leaf and Chain Separately — ACME issuance now splits the returned order certificates into leaf-only certificate data and a normalized issuer chain. This prevents full ACME bundles from being stored twice or treated as both the current certificate and the chain.
ACME Bridge Finalization Validates CSR Identifiers and Persists Async ADCS Certificates — MazeVault's ACME server now rejects finalize CSRs whose DNS/IP identifiers are outside the ACME order, uses the RFC 8555 certificate URL path consistently, and creates the tracked Certificate row when an ADCS-backed ACME order completes after CA manager approval.
External CA Polling Handles DCV, Pending Orders, and Certificate Downloads Correctly — The external CA order poller now counts only resolved orders as completed work, fetches/stores DCV tokens when a provider reports validation is required, downloads certificate bundles for DigiCert and SSLMarket before finalization, and completes request-originated orders atomically across the certificate, queue, request, and agent assignment records.
DCV Retry No Longer Resumes Expired Challenges Prematurely — Operator-triggered DCV retry resets expired or stale challenges before re-fetching provider instructions, handles a missing audit service safely in tests/background contexts, and keeps a queue item in pending_dcv when expired tokens remain instead of incorrectly resuming certificate download.
ADCS DCOM Responses Accept Numeric and String Statuses — The backend DCOM parser now accepts both legacy numeric ADCS disposition codes and agent responses such as pending, issued, or denied, preserving existing behavior while allowing the agent/backend contract to converge safely.
Renewed Certificates Preserve the Backing Internal Signing CA — Renewals that use an internal organization CA account now preserve the backing CertificateAuthority ID on the renewed certificate while continuing to sign through the configured CA account provider. External CA account renewals continue to leave the internal CA field empty.
Approval Continuation Audit Events Carry Rotation Context — Automatic rotation continuation after approval now writes audit events with the rotation intent's project and initiating actor when available, improving traceability without changing continuation idempotency or approval enforcement.
Internal CA HSM Algorithm Inference Is Covered by Regression Tests — The internal CA HSM signer now uses a cleaner type switch for RSA, RSA-PSS, and ECDSA algorithm inference, with tests covering the expected JWA algorithm mapping.
Terraform Write-Only Secret Updates No Longer Replay or Rotate Values During Metadata Changes — Metadata or TTL updates for a Terraform-managed mazevault_secret that uses value_wo now call the backend without a plaintext value unless value_wo_version changes. MazeVault therefore preserves the existing secret material, version history, offload state, external provider state, and propagation behavior during metadata-only applies. Explicit empty secret values are rejected instead of being confused with omitted values.
Terraform CA Account Provider Types Are Validated Consistently — The Terraform mazevault_ca_account resource now rejects empty, whitespace-only, mixed-case, and unsupported provider_type values before any backend API call. The accepted canonical values are aligned with backend CA account resolvers that can actually connect, including internal, the rapidssl SSLMarket alias, and venafi; placeholder I.CA/PostSignum and PSD2 integrations remain excluded until they report a connectable backend status. Venafi account-backed provider resolution is now wired through both CA account service paths, so documented Venafi CA accounts no longer fail in the organization CA-account resolver. Existing documented lowercase configurations continue to work unchanged.

Migration Notes¶

Migration 000189_fix_secret_version_null_uuid repairs invalid secret_versions.id values by replacing missing or zero UUIDs with generated UUIDs. The migration is data-repair only and does not change public API contracts.
Migration 000190_sync_problem_actions adds the sync:write permission to eligible system roles and creates the sync_problem_dismissals table for durable acknowledgement of current sync failure fingerprints. The migration is idempotent and does not change configuration schema or environment variables.

Notes¶

Upgrade Impact — Version 1.0.59 contains two database migrations: 000189_fix_secret_version_null_uuid for legacy secret version UUID repair and 000190_sync_problem_actions for sync remediation permissions and the per-fingerprint dismissal table. Sync-specific API endpoints are added for current sync failure acknowledgement and blocked seed incident acknowledgement; they require no new environment variables or release/package format changes. Terraform write-only secret values require Terraform 1.11+ when value_wo is used with ephemeral inputs; existing value and generate configurations continue to work. Secret update now accepts metadata/TTL-only requests without creating a new version, which is an API compatibility expansion. Secret rotation view refresh is frontend-only, and the Version History author fix is a backend service layer change with no configuration impact. The certificate chain, export, ACME, external CA DCV, new-request async issuance, CA account settings, renewal, approval-continuation audit, HSM, SDK, and Terraform provider changes add no additional migrations, environment variables, Helm values, or release package format changes. Terraform CA account provider type validation now rejects invalid values earlier; documented lowercase provider_type configurations continue to work. CertificateRequest.status can now expose submitted_to_ca while an external CA request is waiting for DCV/provider issuance, and the new renewal queue DCV endpoints reuse existing certificate RBAC permissions.

Version 1.0.58¶

Release Date: 2026-07-16

New Features¶

ACME Challenge Policy on Certificate Templates — Certificate templates now carry a challenge_type field (auto, dns-01, http-01, tls-alpn-01, default auto) that controls how ACME validation is performed when the issuing CA account is an ACME provider (Let's Encrypt, ZeroSSL, custom ACME). The policy is enforced at issuance time in the ACME provider: dns-01 requires a configured DNS solver and fails fast without one, http-01 rejects wildcard identifiers (which ACME cannot validate over HTTP), and tls-alpn-01 returns a clear "not implemented" error instead of silently falling back. auto preserves the previous behavior (wildcard → DNS-01 when a solver exists, otherwise HTTP-01). The field is exposed in the Project Templates certificate wizard, in the certificate template detail views, and via the Terraform provider (mazevault_certificate_template.challenge_type). It is ignored for non-ACME issuers (internal CA, DigiCert, ADCS, …).
ACME Account Attributes in the Terraform Provider — The mazevault_ca_account resource now supports the ACME account fields email, directory_url, eab_kid, and eab_hmac_key (the HMAC key is marked sensitive/write-only). These map into the backend's encrypted credential store, enabling Terraform-managed Let's Encrypt, ZeroSSL, and custom/EAB-gated ACME CA accounts. The existing api_key/base_url attributes remain for API-style providers. The provider now sends the backend-compatible credentials/display_name contract instead of the legacy generic config payload, and write-only credentials are preserved on read (no spurious drift).

Improvements¶

Single Internal CA — Coherent Lifecycle and Management — The organization's internal Certificate Authority is now managed as a single, first-class object under Organization Settings → Project Settings → Certificate Authorities → Internal Certificate Authority. New endpoints resolve, initialize, and repair the internal CA (GET/POST /organizations/{id}/internal-ca, POST /organizations/{id}/ca-accounts/{accountId}/initialize-ca), and creating a second internal root is rejected (single-CA guard). The UI provides an Initialize Internal CA action (common name, key size, validity) and an Initialize CA repair action for internal accounts that were previously created without CA key material. OCSP/CRL URLs are editable and CRL regeneration is available directly from the internal CA card. Agents continue to distribute the CA certificate to server trust stores unchanged.
"Add CA Account" Is Now External-Only — The Add CA Account flow no longer offers an Internal provider option (which previously created a non-functional "hollow" account with no CA key material). Internal CA management lives exclusively in the Internal Certificate Authority section. The internal CA is filtered out of the external CA-account cards to avoid duplicate representation, while remaining fully selectable everywhere else (project integrations, certificate template CA binding, ACME/EAB dialogs).
Strict Renewal Enforcement: Template + CA Required — The certificate renewal pipeline now enforces that every certificate must have a TemplateID and the assigned template must have a CAAccountID before renewal can proceed. Certificates without a template or with a template lacking a CA account are rejected with a clear error message at the pipeline entry point. This eliminates the previous multi-level CA fallback chain (cert-level CA, project overrides, internal CA default) and establishes template.CAAccountID as the single source of truth for CA resolution during renewal.

Bug Fixes¶

Internal CA No Longer Reported as "Not Found" When It Exists — The Certificate Authorities tab previously enumerated project-scoped CAs to display internal CAs, so the organization-level internal CA (which has no project binding) was invisible and the section always showed "No internal CAs found." The section now resolves the internal CA through the organization's internal CA account link and displays it correctly, including its OCSP/CRL configuration.
OCSP/CRL Configuration Persists for Org-Level Internal CA — Editing OCSP/CRL URLs for the internal CA now uses the CA-scoped endpoint (PUT /ca/{id}) instead of a project-scoped path that could not address an org-level CA (project_id = NULL). OCSP remains internal-CA-only by design — external CAs (DigiCert, Let's Encrypt, ZeroSSL) continue to advertise their own OCSP/CRL responders via the embedded AIA/CDP pointers.
Integration Deletion Impact Now Excludes Soft-Deleted Secrets — The raw SQL aggregates behind affectedSecretCount and collectOrphanedSecretIDs filtered only archived_at IS NULL, ignoring GORM soft-deletes (deleted_at). This could inflate the reported "total affected" / orphaned counts relative to every other code path that queries secrets via GORM (which applies deleted_at IS NULL automatically). Both raw queries now also filter deleted_at IS NULL, restoring a single, consistent secret population across the delete result, the deletion-impact endpoint, the audit log, and the per-environment breakdown.
Delayed Secret Rotation No Longer Records a Refresh That Did Not Happen — markDelayedSecretReauthorizing set refresh_performed=true in the execution metadata before the single re-authorization call actually ran, so a crash or failure before AuthorizeRotationConfigPublish persisted a misleading refresh_performed=true even though no refresh completed. The placeholder now records refresh_performed=false; the flag is set to true only on the successful re-authorization path. At-most-once semantics are unchanged — the loop guard relies on refresh_attempted + refresh_generation.

Removals¶

ProjectCAOverride Removed — The project_ca_overrides table and all associated code (model, handlers, service method findProjectCAOverride) have been removed. This feature was never exposed via the API router (routes were not registered) and the table was always empty in production. The renewal orchestrator now resolves CA exclusively from the template. Migration 000188 drops the table.
buildTemplateFromCert Removed — The synthetic template fallback for certificates without a template has been removed. Certificates must be assigned a proper template before they can be renewed.

Maintenance¶

Dead PKI UI Removed — Three orphaned, unreachable frontend components were deleted after confirming no capability loss: CAManagementTab (its Initialize CA / HSM / CRL capabilities are superseded by the Internal Certificate Authority section) and CertificateTemplatesTab + CertificateTemplateModal (superseded by the variable-driven Project Templates certificate flow, which covers subject DN and SANs via template variables). The live CertificateTemplateViewModal (used by the project Templates tab) is retained.
Migration 000188 Header Comment Corrected — The header comment in 000188_drop_project_ca_overrides.up.sql incorrectly referenced "Migration 000187"; it now correctly reads "000188". No functional change.

Migration Notes¶

Migration 000188_drop_project_ca_overrides drops the project_ca_overrides table. This is a non-destructive change as the table was never populated through the application (API routes were never registered).
Certificates without a TemplateID that previously relied on the internal CA fallback will now report "no template assigned" in the rotation dashboard and cannot auto-renew until a template is assigned.

Notes¶

Upgrade Impact — Version 1.0.58 adds two database migrations: 000182_add_challenge_type_to_certificate_templates (adds a challenge_type VARCHAR(20) DEFAULT 'auto' column with a CHECK constraint to certificate_templates) and 000188_drop_project_ca_overrides (drops the always-empty project_ca_overrides table). Both migrations are idempotent and backward-compatible; existing templates default to auto and existing ACME issuance behavior is unchanged. No configuration schema changes.
Terraform Provider — Existing mazevault_ca_account configurations continue to work; the new ACME attributes are optional. mazevault_certificate_template gains an optional, defaulted challenge_type attribute. The internal CA is intentionally not managed via Terraform — it is managed in the MazeVault UI.

Version 1.0.57¶

Release Date: 2026-07-07

Bug Fixes¶

Rotation Sync Steps (pre/post_rotation_sync) Now Use Managed Identity Instead of Stale Config Credentials — When the rotation orchestrator's pre_rotation_sync or post_rotation_sync steps resolved Azure credentials via getAzureCredentialFromConfig, the function auto-detected client_secret fields from the encrypted integration config blob even when the integration was configured with background_auth_method=managed_identity. This caused AADSTS7000215 (invalid client secret) errors during rotation sync steps while the identical Key Vault connection succeeded during non-rotation sync paths. The credential helper now prefers system managed identity when auth_method is empty and the system has a configured MI, preventing stale SSO app credentials from being picked up. Additionally, the gateway delegation layer no longer blocks delegation solely because managed identity is present, and delegated sync steps now carry a secret_metadata snapshot so gateway-executed sync steps can resolve the target secret key without requiring a direct database lookup.
Gateway Delegation No Longer Blocked by Managed Identity Presence — canDelegateEnvironment() previously returned false unconditionally when the credential factory reported managed identity availability, preventing any Azure KV sync delegation to gateways in environments where MI was configured. This gate has been removed; gateway delegation now relies solely on environment matching and gateway availability, allowing MI-authenticated sync operations to be properly delegated.
Orchestrator Mode Rotation No Longer Performs Duplicate Key Vault Push — In orchestrator mode (storage_mode=names_only), the mazevault_secret rotation step previously called SecretService.Update which internally pushed the new value to the external vault via PushSecretToEnvironment. Since post_rotation_sync also pushes the same value to the vault, every rotation produced a redundant duplicate write. The step now calls BumpVersion() (local version counter increment only) in orchestrator mode and defers the sole external write to post_rotation_sync.
Orchestrator Mode Rotation Compensate No Longer Fails on Empty EncryptedValue — When a rotation saga rolled back the mazevault_secret step in orchestrator mode, Compensate() attempted to decrypt the previous version's EncryptedValue which is always NULL/empty for names_only secrets. This caused spurious "partially_rolled_back" statuses. The compensate path now returns nil immediately for orchestrator-mode secrets — rollback of the external vault value is handled by PostRotationSyncStep.Compensate which has the per-integration pre-overwrite snapshot.
Pre-Rotation Sync No Longer Round-Trips Value Back to Key Vault in Orchestrator Mode — When pre_rotation_sync detected a newer value in Azure Key Vault, it called UpdateSecret which in orchestrator mode pushed the same value right back to the vault (redundant network call). In orchestrator mode the step now captures the KV value as previous_value context for downstream steps without triggering a local DB write or external push.
Agent Discovery Report No Longer Silently Drops Metadata Update — ProcessDiscoveryReport() persisted discovered certificates into the database but never updated the agent's own metadata (last_discovery_at, discovered_certificates_count). After a successful discovery run the agent row remained stale, making it impossible for operators to tell from the dashboard whether an agent had ever performed discovery or how many certificates it found. The transaction now concludes with an atomic count query and agent row update so dashboard stats reflect reality immediately after each report.
Agent Version Not Persisted from Health Heartbeat — UpdateHealth() stored the full health payload into the health_status JSONB column and refreshed last_seen, but never extracted the agent_version string into its dedicated column. Agents reporting their version via the heartbeat appeared as version-unknown in the UI. The handler now copies agent_version from the health map into the agent model before saving.
Empty Environment Dropdown in Bind Agent Dialog — The "Bind Agent" dialog on the Project Integrations tab fetched environment data from GET /projects/:id/environment-settings (which returns ProjectEnvironmentSetting[] with an environment field) but rendered the list expecting Environment[] objects (with slug and name fields). Because the field names didn't match, every dropdown item appeared blank. The dialog now fetches from GET /organizations/:orgId/environments which returns the correct Environment[] shape, populating the dropdown correctly.

Version 1.0.56¶

Release Date: 2026-07-01

Improvements¶

Release Pipeline Security Gating Expanded — The development CI pipeline now scans all shipped images, including docs and init-certs, and the release pipeline now scans docs as well and fails the release on CRITICAL/HIGH Trivy findings instead of reporting them passively. This closes a blind spot where auxiliary images could ship with unresolved vulnerabilities even when backend, frontend, and ocsp were clean.
Base Image and Local Runtime Alignment — init-certs now builds from the pinned Dockerfile.init-certs path in local docker-compose instead of running an ad-hoc alpine:latest bootstrap command. The init-certs image moved to Alpine 3.21 with a package upgrade during build, and the docs runtime stage now refreshes Alpine packages before packaging nginx. This reduces drift between CI artifacts and local runtime behavior and lowers exposure to known OS-package CVEs.
Backend Dependency Refresh for Reachable Integrations — Patched Go versions are now pinned for github.com/Azure/go-ntlmssp, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, github.com/aws/aws-sdk-go-v2/service/s3, github.com/quic-go/quic-go, and go.mongodb.org/mongo-driver, covering reachable optional paths such as ADCS NTLM authentication, S3 audit archive transport, QUIC stack usage, and MongoDB reconciliation and rotation code.

Bug Fixes¶

Request ID Tracing Normalized Across Middleware and Logs — RequestIDMiddleware now populates both requestID and the legacy request_id Gin context key while continuing to emit the X-Request-ID response header, and environment-resolution warnings now read the canonical requestID key. This removes a traceability gap where some logs emitted an empty request ID even though a request ID had already been assigned.
Orchestrator Mode Guard Uses Exact Route Patterns — The orchestrator ingress guard no longer relies on raw URL suffix and substring heuristics. It now matches registered Gin route patterns via c.FullPath() for secret write routes in both /api/v1/secrets and /api/v2/secrets, while avoiding false positives on nested certificate import flows. Direct secret payloads carrying value remain blocked in orchestrator mode, but legitimate certificate-import endpoints are no longer at risk of accidental interception.
Entra Selected-App Sync Now Stays Pending Until Scoped Bindings Exist — When an Entra integration is configured with selected_apps scope but no selected application bindings have been saved yet, a manual sync now returns HTTP 409 Conflict instead of being reported as a generic failure. The integration is recorded with last_sync_status = pending, last_sync_error stays empty, and the hourly scheduler logs a skip until at least one selected application is configured. This makes the API and operational status truthful during staged onboarding.
Sync Rule Status and Audit Surfaces Now Preserve Execution Provenance — Sync executions now persist a canonical execution record and propagate the resulting execution_id, trigger_source, trigger secret/environment, and aggregate outcome counts into rule status and sync-log metadata. Bidirectional sync also suppresses the immediate echo-push of secrets that were just pulled or left unchanged by the pull stage, reducing pointless external churn while keeping sync_rules.last_sync_status and project_integrations.last_sync_* aligned with the final outcome.
Rotation Step 0 (connection_validation) Now Respects Integration background_auth_method — When the rotation orchestrator executes locally (non-delegated path), the TestConnection() method for Azure Key Vault integrations now calls prepareAzureIntegrationRuntimeConfig() before attempting the connection. Previously, stale client_secret credentials in the encrypted integration config would override the configured background_auth_method=managed_identity, causing ClientSecretCredential authentication failed errors during rotation while sync (which already used the correct preparation path) continued to succeed. The fix ensures auth method resolution is consistent across sync and rotation execution paths.

Notes¶

Upgrade Impact — Version 1.0.56 contains no database migrations and no configuration schema changes. Existing API contracts remain stable; the main operational change is stricter release gating, so CI and release jobs can now fail if docs or init-certs images contain unresolved CRITICAL/HIGH findings.
Local Development Impact — The first docker compose up --build after upgrading rebuilds the dedicated client-init-certs image instead of downloading a generic Alpine base and running inline package installation. Build time may increase slightly, but local behavior now matches the shipped image path more closely.

Version 1.0.55¶

Release Date: 2026-06-29

New Features¶

Secret Rotation Targets — Full CRUD management for secret rotation targets is now available via API, frontend, Go SDK, and Terraform. Targets define the deployment destinations (Kubernetes secrets, database password rotation, agent sync, DevOps pipeline variables, cloud vaults) that MazeVault pushes updated credentials to immediately after a rotation completes. The new SecretRotationTargetList component in the Secrets tab lets operators add, edit, and remove targets without leaving the project view. The Terraform resource mazevault_secret_rotation_target enables fully declarative management; the config_json argument accepts a jsonencode()-encoded JSON object describing the target-specific configuration.
Internal CA Configuration Update + AIA Backfill — Two new API endpoints allow updating mutable fields on an internal CA account without recreating it: PUT /api/v1/ca/:id and PUT /api/v1/projects/:id/ca/:caId accept ocsp_url, crl_url, and ocsp_responder_cert_id with patch semantics (omitted fields are left unchanged). A companion POST /api/v1/admin/certificates/backfill-aia endpoint retroactively copies the current OCSP and CRL URLs from a CA account into all existing certificates it issued. OCSP URL, CRL Distribution Points, and Issuer Certificate URL extensions are now properly embedded in the x509 template inside InternalCAProvider.SignCSR() for all newly issued certificates.
Agent Selection in Rotation Config UI — The SecretPostRotationActionsPanel and SecretRotationTargetEditor now expose a dropdown that allows an operator to bind a specific registered agent to a rotation target. This gives precise control over which on-premise agent executes a deployment step without relying solely on environment-based routing.
Certificate Template View Modal — A new CertificateTemplateViewModal component provides a full-detail read-only view of any certificate template (SAN patterns, key usage, extended key usage, validity period, CA account binding) without navigating away from the current page. The modal is accessible from both the organisation-level CertificateTemplatesTab and the project-level TemplatesTab. The view now also surfaces the signature algorithm (falling back to the CA default when unset) and the ACME profile name, and annotates validation-only constraints and external-CA-governed fields so operators understand which settings are enforced by MazeVault versus the issuing CA.
Certificate Templates Now Govern Issuance End-to-End — Certificate templates have been promoted from a partially-decorative metadata record into the authoritative governance "cookbook" for certificate issuance across the full lifecycle. Template fields that were previously stored but never applied are now honoured by the signing engine and the CSR generator: max_path_length (with explicit path-length-zero handling for CA certificates), certificate policy OIDs (policy_identifiers / certificate_policies), signature_algorithm, the default common-name template (cn_template), and the subject email. A new Governance tab in CertificateTemplateModal exposes approval requirements, allowed environments, and allowed key sizes, and a dedicated Renewal & Rotation section makes the key-reuse policy independently settable. Template defaults are now normalised on create/update (validity_days → 365, key_size → 256/2048 by algorithm, min/max validity windows) so a template can never persist inert zero values.
Project & Config Template View Modals — Two new read-only detail modals, ProjectTemplateViewModal and ConfigTemplateViewModal, bring the same at-a-glance inspection experience already available for certificate templates to project templates (general settings, environment rules, variable schema, protocol configuration) and configuration templates (metadata, definition summary, raw JSON). Both are reachable via a view (eye) action in their respective management tabs.
Terraform: Certificate Rotation Config, Entra Rotation Config, and Rotation Resources Data Source — Three new Terraform surfaces complete IaC coverage of the rotation platform: mazevault_certificate_rotation_config manages automatic renewal scheduling and post-rotation action lists for a specific certificate; mazevault_entra_rotation_config manages Entra ID credential rotation settings including days-before-expiry threshold and staged-rotation behaviour; mazevault_rotation_resources is a data source that lists all rotation-managed resources with their current status, filterable by kind and environment_scope.

Environment Identity Reform¶

Environment Identifiers Are Now Stored Verbatim and Matched Exactly — Environment identifiers entered in Organization Settings are the single source of truth. The system now stores them verbatim (case-preserving) and matches them exactly (case-sensitive) everywhere — RBAC, secrets, sync rules, gateway routing, gateway tasks, environment locks, and the frontend. Identifiers that differ only in case (for example developmentA, DeveLopmentB, DeveLopmentC) are treated as distinct environments. The system never silently rewrites, lowercases, trims, or alias-maps what an operator entered.
CanonicalizeEnvironment is now validate-only: it rejects empty/whitespace-only, reserved (*, default, all, system, none), too-short/long, and malformed identifiers (allowed shape ^[A-Za-z][A-Za-z0-9_-]{1,31}$), and returns the input unchanged on success.
The gateway environment alias map (pro→production, npr→nonproduction, etc.) has been removed from both backend and frontend. SupportsEnvironment(), GetEnvironmentMode(), gateway routing, health-monitor failover, and the frontend environments helper now compare identifiers exactly. The frontend environment helper no longer applies toLowerCase()/token normalization, and all environment selectors source their options exclusively from the organization environment list.
Impact: existing customer environment data is uniformly lowercase, so exact case-matching is a no-op for current records — zero RBAC/secret/sync regression. Mixed-case identifiers are supported going forward only.

Improvements¶

Rotation Pre-Execution Probe Completeness (Gateway, Agent, and Entra Runtime) — The rotation orchestrator now verifies every required execution target is reachable before the first mutating step, and returns a structured HTTP 412 error when a rotation cannot safely start. Three new error codes — rotation_blocked_no_gateway, rotation_blocked_agent_offline, and rotation_blocked_runtime_unavailable — are surfaced instead of an opaque 500/409. The probe is now certificate-aware (it resolves CertificateRotationConfig targets correctly), collects all required agent IDs across every agent-bearing workflow step, and is also enforced inside executeCertificateWorkflow. Entra credential rotation runs the same runtime probe in RotateCredentialWithRequest before the lifecycle transitions to rotating, so a blocked runtime never leaves a credential half-rotated. A credential or certificate change that cannot be deployed now fails fast and visibly rather than starting and stalling.
Gateway Delegation for Azure Key Vault Sync — Azure Key Vault push and pull sync operations are now delegated to the appropriate gateway when the backend detects that the direct network path to the Key Vault endpoint is not available. Gateway tasks carry the integration configuration and perform the actual Azure SDK calls; the primary backend records only the resulting sync state. The sync rule scheduler start has been deferred to after gateway delegation is fully initialized, preventing transient DNS resolution errors during backend startup.
Rotation Config — Target Environment Auto-Fill — When GetConfigBySecretID creates a new rotation configuration for a secret that does not yet have one, target_environment is now automatically populated from the secret's own environment. This eliminates a manual follow-up update step that was previously required before the first rotation could be triggered.

Bug Fixes¶

Gateway Environment Matching Reworked to Verbatim/Exact Identity — Earlier in this release cycle, gateway environment matching relied on a case-insensitive alias map (pro→production, npr→nonproduction, etc.) that could silently map unrelated identifiers together and mutate operator-entered values. This approach has been replaced by the verbatim/exact environment-identity model (see Environment Identity Reform above): SupportsEnvironment() and GetEnvironmentMode() now compare exactly, the alias map is removed, and the previously planned alias-normalization migration 000176 has been neutralized to a no-op (it was never shipped to customers). Forward migrations 000178/000179 remove the lowercase-enforcing CHECK constraints and case-insensitive unique indexes so case-distinct identifiers are accepted.
AIA Extensions Not Embedded in Issued Certificates — InternalCAProvider.SignCSR() read ocsp_url and crl_url from the CA record but never wrote them into the x509 certificate template, so every certificate issued by an internal CA had empty Authority Information Access and CRL Distribution Points extensions. Both extensions are now correctly embedded for all new certificates. Existing certificates can be retroactively updated via the new backfill endpoint.
Device Fingerprint — Concurrent Insert Race Condition — The anomaly detection service could produce duplicate-key constraint violations when two concurrent authentication requests from the same previously unseen device tried to register its fingerprint simultaneously. The insert path now uses an upsert pattern with an ON CONFLICT DO NOTHING guard to handle concurrent registrations gracefully.
Sync Rule Scheduler — DNS Errors at Backend Startup — On backends configured with gateway delegation, the sync rule scheduler's first scheduled execution could fail with DNS resolution errors because it started before the gateway delegation subsystem had completed initialisation. The scheduler start is now deferred until the delegation layer is ready.
Terraform Organization Resource — Delete Silently Swallowed Errors — The Delete method in the Terraform mazevault_organization resource returned success even when the backend responded with a non-2xx status code. Backend errors are now surfaced as Terraform diagnostics so terraform destroy fails visibly instead of leaving the resource in an inconsistent state.
Certificate Policy OIDs Silently Dropped from Issued Certificates (Go 1.24+) — InternalCAProvider.SignCSR() populated only the deprecated x509.Certificate.PolicyIdentifiers field. Go 1.24+ x509.CreateCertificate emits the Certificate Policies extension from the new Policies ([]x509.OID) field instead, so template-declared policy OIDs were silently omitted from every issued certificate. SignCSR now populates both fields — the modern Policies slice (for current encoders) and the legacy PolicyIdentifiers slice (for older parsers) — so policy OIDs are reliably embedded.
Certificate Template Signing & Subject Fields Were Inert — max_path_length, signature_algorithm, certificate policy OIDs, the default common-name template, and the subject email were persisted on certificate templates but never reached the issued certificate or generated CSR. All of these template fields are now applied during signing and CSR generation, closing the gap between what a template declares and what a certificate actually contains.
External CA Template Import Persisted Zero validity_days / key_size — Templates imported from external CA providers (ADCS, SmallStep) were stored with validity_days = 0 and key_size = 0, which then surfaced as invalid defaults in the template editor. Imported templates now carry sane defaults (key_size = 2048, valid_days = 365), and the service layer normalises any remaining zero values on create/update as a defence-in-depth backstop.

Database Migrations¶

000176_normalize_gateway_environments — Neutralized to a no-op (SELECT 1). This migration originally normalized legacy environment aliases to canonical slugs, but the environment identity reform reversed that direction (identifiers are now stored verbatim). Because the migration was never released to any customer, both its .up.sql and .down.sql are now documented no-ops, leaving customer gateway data untouched.
000177_certificate_templates_signature_algorithm — Adds the signature_algorithm VARCHAR(50) column to certificate_templates (idempotent ADD COLUMN IF NOT EXISTS) so templates can pin the issuance signature algorithm. The matching .down.sql drops the column. ExpectedColumns["certificate_templates"] in database_health.go was updated accordingly.
000178_relax_canonical_environment_check — Drops the 11 chk_*_canonical CHECK constraints (added by migration 000125) that required column = LOWER(column) on every environment-bearing column. These constraints would reject case-distinct identifiers, contradicting the verbatim contract; application-side validation (CanonicalizeEnvironment) continues to enforce shape, length, and reserved-word rules. The down migration re-adds the constraints. Idempotent (DROP CONSTRAINT IF EXISTS).
000179_case_sensitive_environment_indexes — Replaces the case-insensitive LOWER() unique guardrails from migration 000122 with an exact, case-sensitive unique index uniq_environments_org_slug (organization_id, slug) and restores plain raw-column lookup indexes for every environment-bearing column. Existing per-project uniqueness (idx_project_env) is already exact. The down migration restores the LOWER() indexes. Idempotent.

Version 1.0.54¶

Release Date: 2026-06-27

Bug Fixes¶

Entra Credential Watchdog — Stuck Detection Permanently Bypassed by Hourly Sync — The PostgreSQL trigger trg_entra_creds_updated refreshes updated_at = NOW() on every UPDATE to entra_credentials, including the non-state field writes performed by the hourly reconciliation sync (syncedEntraCredentialUpdates). This meant updated_at < now() - 30min was never true for any credential that went through a sync cycle, preventing the watchdog from ever firing. A new rotation_started_at TIMESTAMPTZ column (migration 000175) is set when lifecycle_state transitions to rotating and cleared on rollback or watchdog recovery. The watchdog query now uses rotation_started_at IS NULL OR rotation_started_at < cutoff; IS NULL covers credentials already stuck before the migration was applied.
Entra Expiry Monitor — Preload("") GORM Error on Every Hourly Check — checkExpiringCredentials called .Preload("") (empty string) on the GORM query. GORM v2 rejects this with unsupported relations for schema EntraCredential, logging an error every hour and preventing the expiring_soon lifecycle state from being set on credentials that genuinely are expiring. The invalid .Preload("") call has been removed; behavior is otherwise unchanged.
Sync Rule Pull — secret_versions_created_by_fkey FK Violation for System Actors — SyncRuleService.executePull calls SecretService.Update with req.UserID = uuid.Nil (no authenticated user). Update unconditionally stored &req.UserID as created_by in the new SecretVersion row; GORM serializes *uuid.Nil as the string '00000000-...' rather than SQL NULL, which violates the non-null FK referencing the users table. The fix adds a nil-guard: created_by is set to NULL when the caller supplies a zero-value UUID, matching the nullable column contract.
Azure KV Integration — Synced Secrets Displayed as "Stored Locally" — syncAzureKeyVaultLocal created and updated secrets in the secrets table but never inserted a SecretIntegrationLink row with link_purpose = 'sync_source'. GetSecretSyncStatus therefore returned local_only for every KV-synced secret and the UI showed "Stored Locally" instead of "Synced from KV". The fix inlines the same upsert logic used by SyncRuleService.upsertPullLink directly in IntegrationService using s.db and clause.OnConflict, avoiding a cross-service dependency.

Improvements¶

Role Permissions — agent:admin Added to secret_manager and certificate_manager Roles — Agent management operations (agent:admin) have been added to the secret_manager and certificate_manager system roles (migration 000174). Operators holding only one of these roles can now register and configure agents without requiring a separate admin role assignment.

Database Migrations¶

000174_agent_admin_for_managers — Grants agent:admin permission to the secret_manager and certificate_manager built-in roles.
000175_entra_credentials_rotation_started_at — Adds rotation_started_at TIMESTAMPTZ to entra_credentials. Includes partial index idx_entra_creds_rotation_started over (rotation_started_at) for the rotating and pending_verification lifecycle states.

Version 1.0.53¶

Release Date: 2026-06-26

Bug Fixes¶

OCSP — Certificate Existence Not Verified Before Stapling — The OCSP service responded to stapling requests without first confirming that the referenced serial number exists in the local certificate store. An attacker with a forged or recycled serial could have elicited a valid OCSP response for a non-existent certificate. The service now verifies certificate existence before constructing a response, returning Unknown status for unrecognised serials.
Rotation Step — PostgreSQL Grants Vulnerable to SQL Injection — rotation_steps/postgres_db.go constructed GRANT/REVOKE statements by string-concatenating the caller-supplied role name and privilege list without quoting. Database role names are now double-quoted using pgx-style identifier escaping, closing the injection path.
SSH Keys — ExportPrivateKey Missing Authorization Check — ExportPrivateKey did not verify that the requesting user had ownership or admin rights on the SSH key before returning the encrypted private material. The handler now enforces the same project-membership and ownership check applied to all other SSH key mutation endpoints.
SSH Rotation — Incorrect API Response Field Mapping for Key Pairs — The SSH rotation response handler mis-mapped key-pair fields, causing the returned public_key and key_id to be swapped or empty after a successful rotation. The field mapping has been corrected.
Keytab Rotation — Unstructured Logging Bypassing Structured Pipeline — Keytab rotation errors were emitted via the legacy log package, bypassing the structured logging pipeline and losing request-scoped fields. All log calls in keytab_rotation_executor.go are now routed through slog.
CA Accounts — ca_authority_id Not Persisted on Update — UpdateCAAccount silently discarded ca_authority_id when updating an existing CA account because the field was absent from the GORM Updates map. The field is now included and covered by a new test.
CRL / Revocation Schema Drift — OCSP Returns 500 — The revocation_entries and certificate_revocation_lists tables were created by migration 000005 with legacy column names (reason_code, crl_pem) that diverged from the current GORM model fields (revocation_reason, raw_content). GORM appends deleted_at IS NULL to every query; because deleted_at was absent from the production schema the entire CRL/OCSP subsystem returned SQLSTATE 42703 errors. Migration 000173 adds all missing columns with idempotent ADD COLUMN IF NOT EXISTS guards and backfills values from the legacy columns.

Improvements¶

Rotation Trigger — Request Body Optional — The rotation trigger endpoints now accept requests with an empty or absent body; reason defaults to "manual" when not supplied.
CA Internal — HSM OCSP Signing Deferred with Explicit Documentation — OCSP response signing via HSM is explicitly deferred; the code path now carries a clearly marked comment and returns a software-signed response in the meantime, preventing silent fallbacks.
Feature Flags — Gateway Mode and License Validation Hardened — features.go tightens the evaluation logic for gateway_mode and license-gated features, eliminating a class of false-positive enabled results when the license payload is partially parsed.
SRP — MFA Step Sequencing Documented — The SRP session-verification flow now carries an explicit comment documenting MFA step ordering and the rationale for the current TOTP/backup-code sequence.
Secret Naming Policy Wizard — Auth Context Threaded to Token Management — The SecretNamingPolicyWizard now passes the authenticated user context through to token-management calls, closing a potential unauthenticated call path in the wizard's save flow.

Database Migrations¶

000173_fix_revocation_crl_schema_drift — Adds missing columns to revocation_entries (crl_id, revocation_reason, updated_at, deleted_at) and certificate_revocation_lists (raw_content, updated_at, deleted_at). Backfills from legacy columns reason_code and crl_pem. Fully idempotent.

Version 1.0.52¶

Release Date: 2026-06-23

Bug Fixes¶

Renewal Policy Schema — key_reuse_enabled and validity_duration Missing from Database — The certificate_renewal_policies table was created by migration 000010 using the column name reuse_private_key; the Go model was later renamed to key_reuse_enabled without a companion migration, causing every write that touched the field to fail at the database layer. Migration 000172 adds key_reuse_enabled BOOLEAN NOT NULL DEFAULT FALSE (with a backfill from the legacy reuse_private_key column) and validity_duration INT NOT NULL DEFAULT 0. The same migration converts notify_emails from JSONB to TEXT using a three-step staging approach (add TEXT column → UPDATE via set-returning function → drop JSONB column → rename), working around the PostgreSQL restriction that forbids subqueries inside ALTER COLUMN TYPE … USING.
Renewal Queue — certificates.organization_id Column Does Not Exist — GetRenewalQueue filtered WHERE certificates.organization_id = ? but the certificates table only carries project_id; organization is reachable via certificates.project_id → projects.organization_id. The service now performs a second JOIN (JOIN projects ON projects.id = certificates.project_id) and filters on projects.organization_id.
SDK and Terraform Provider — notify_days_before []int Semantic Mismatch — The Go SDK (sdks/go/models.go) and Terraform provider (internal/resources/renewal_policy.go) declared a notify_days_before []int field that has never existed in the backend. The backend stores a plain comma-separated string under notify_emails. Both were rewritten to use notify_emails string, and the two new fields key_reuse_enabled and validity_duration were added to align with the live API contract. Acceptance tests that were blocked with t.Skip due to these gaps are now live.

Database Migrations¶

000172_fix_certificate_renewal_policy_schema — Adds key_reuse_enabled BOOLEAN NOT NULL DEFAULT FALSE (backfilled from reuse_private_key), validity_duration INT NOT NULL DEFAULT 0, and converts notify_emails JSONB → TEXT to certificate_renewal_policies.

Version 1.0.51¶

Release Date: 2026-06-22

New Features¶

Acknowledge Rotation Failure — Operators can now permanently dismiss a reviewed rotation failure from the Rotation Problems dashboard without deleting the underlying execution record. A new POST /api/v1/dashboard/rotation/failures/{id}/acknowledge endpoint (RBAC: dashboard:write) writes acknowledged_at and acknowledged_by to the execution row. The dashboard query filters acknowledged rows, keeping the view focused on items that still require attention. The UI exposes a "Mark as reviewed" action from the failure detail panel.
Entra Credential Stuck Watchdog — A new background watchdog (RecoverStuckEntraCredentials) runs every 5 minutes and resets Entra credentials stuck in rotating or pending_verification lifecycle state for more than 30 minutes. This prevents indefinite stalls caused by backend restarts or goroutine cancellations mid-rotation. Each recovery writes stuck_watchdog_recovered_at to the credential row for auditability.
Entra Credential Status — pending_verification — The entra_credentials_status_check constraint was extended to allow the pending_verification value written by RotateCredentialWithRequest after every rotation when downstream propagation targets are configured. Without this, any rotation with propagation would produce a constraint violation and leave the credential in an inconsistent state.
CA Account — Assigned Certificates Count — The CA account list and detail responses now include assigned_certificates_count, the number of active certificates issued via certificate templates bound to that CA account. This gives operators an immediate signal of a CA account's active footprint without an additional query.
Terraform Provider — User, User Role, Keytab, Project Settings, Shared Secret — Five new Terraform resources complete the provider's coverage of the MazeVault user-management and project-configuration surfaces: mazevault_user (create/read/update/delete of platform users), mazevault_user_role (assign roles to users within an organization), mazevault_keytab (manage Kerberos keytab files attached to a project), mazevault_project_settings (project-scoped configuration knobs), and mazevault_shared_secret (secrets shared across multiple projects).

Improvements¶

Rotation Problems — Acknowledged Filter — The Rotation Problems page and the platform summary service exclude acknowledged executions from failure counts and lists by default, using the partial index idx_rotation_executions_unacknowledged introduced in migration 000170.

Database Migrations¶

000169_entra_credentials_status_pending_verification — Extends the entra_credentials_status_check constraint to include pending_verification.
000170_rotation_execution_acknowledgement — Adds acknowledged_at TIMESTAMPTZ and acknowledged_by UUID REFERENCES users to rotation_executions. Includes partial index idx_rotation_executions_unacknowledged covering only un-acknowledged rows.
000171_entra_credential_stuck_watchdog — Adds stuck_watchdog_recovered_at TIMESTAMPTZ to entra_credentials. Adds partial index idx_entra_creds_stuck_watchdog over (lifecycle_state, updated_at) for the two in-flight states.

Version 1.0.50¶

Release Date: 2026-06-21

New Features¶

Rotation Config Templates — A new reusable rotation policy blueprint system allows operators to define shared rotation settings (interval, lead days, retention window, max retries, timeout) that can be applied across multiple secrets and certificates. Managed via five new API endpoints under GET|POST /api/v1/rotation/templates and GET|PUT|DELETE /api/v1/rotation/templates/{id} with full RBAC (rotation:read / secret:rotate). A dedicated Terraform resource mazevault_rotation_template enables IaC-driven management. The frontend exposes a full CRUD management page at /rotation/templates. Migration 000168 adds the rotation_config_templates table and a template_id foreign key on rotation_configs.
Sync Rule — Bidirectional Mode and Conflict Strategy — The SyncRuleModal now exposes configurable sync direction (pull / push / bidirectional) and sync mode (incremental / full_sync) fields. Both attributes are persisted server-side and documented in the new Terraform resource mazevault_sync_rule. Pull-sync operations now write last_pulled_at, link_purpose, and external_secret_path into secret_integration_links (migration 000167), enabling the synced_from_external status badge on secrets that were pulled from an external provider.
Dry-Run for Certificate Rotation — The Certificate Rotation tab now includes a "Dry Run" button alongside the existing "Trigger Rotation Now" action. Dry-run executes the full rotation workflow validation — including post-rotation action preflight and gateway probing — without committing any changes. The dry_run flag is propagated end-to-end through the API and all rotation steps.
Post-Rotation Action — Gateway Pinning and Environment Override — PostRotationAction now accepts an optional gateway_id field that pins the action to a specific gateway, bypassing environment-based routing. A companion target_environment field overrides the environment context used when resolving the target. Both fields are available in the Go SDK (PostRotationActionWF) and in the Terraform mazevault_rotation_workflow resource.
Terraform Provider — Sync Rules and Rotation Templates — Two new Terraform resources cover the full create/read/update/delete lifecycle: mazevault_sync_rule (sync direction, conflict strategy, key transform, path prefix) and mazevault_rotation_template (interval, lead days, retention, retry policy). Both are registered in the provider and documented in docs/resources/.
Rotation Problems — Failed Executions Detail View — The Rotation Problems page now renders a detailed failed-execution table with per-resource drill-down, a pie-chart distribution by resource kind, and a missing-secrets breakdown. Navigation from the sidebar highlights the section with a warning icon.

Improvements¶

Distributed Sync Semaphore via Redis — SyncRuleService now uses a Redis-backed distributed lock (SET NX PX) through a new TryAcquireLock / ReleaseLock pair on CacheService. When Redis is unavailable the service falls back to an in-process sync.Map lock. This prevents duplicate concurrent syncs for the same rule in multi-replica deployments.
Dry-Run Guard in All Rotation Steps — All seven built-in rotation steps (password generator, Azure Key Vault, Spring Actuator, agent command, shell script, IIS recycle, Kubernetes secret) now check the dry_run flag before making any mutating external call and return a preview result instead.
Connection Validation Scope Extended — The connection_validation rotation step was extended to cover non-database provider types (Azure Key Vault, Kubernetes, LDAP, GitHub, GitLab, generic webhook), ensuring pre-execution connectivity checks are not silently skipped for secrets backed by those integrations.
names_only Secret Rotation Guard — The rotation orchestrator now rejects rotation requests for secrets with storage_mode = names_only with a clear error message, preventing misleading execution records for secrets whose value lifecycle is managed entirely by the external provider.
Secret Sync Status — synced_from_external Indicator — GetSecretSyncStatus now returns synced_from_external when a secret has been successfully pulled from an external provider. The Secrets tab surfaces this as an informational "Synced from KV" badge.
Compliance Report — Deployment and Sync Coverage Stats — PasswordPolicyStats is extended with secrets_with_deployment_target, secrets_with_external_sync, and secrets_with_template counters. The compliance report service gathers these in a single additional DB pass.
Gateway Task Service — Direct Gateway ID Pinning — GatewayTaskService.CreateTask now accepts an optional GatewayID that, when set, skips the routing-service lookup entirely and dispatches the task directly to the named gateway. This supports pinned post-rotation actions without routing ambiguity.
Code Readability — Internal service and model struct fields were reformatted for consistency. resolveRotationResourceIncidentTarget parameters were simplified, removing redundant intermediate variables.

Bug Fixes¶

Dashboard Dismiss — TypeScript Type Narrowing — The dismiss handler for actionable rotation items now correctly narrows item.status from 'overdue' | 'failed' | 'running' to the server-accepted 'overdue' | 'failed' union before sending the dismiss request, fixing a TypeScript compile error introduced when 'running' was added to the item status type.
Rotation Template Routes Missing After Refactor — The five /api/v1/rotation/templates route registrations were inadvertently removed during a code-formatting pass. All five routes have been restored with their original RBAC middleware (rotation:read / secret:rotate).
Swagger Path Drift for Rotation Templates — Swagger @Router annotations in handlers_rotation_templates.go incorrectly used /rotation-templates instead of the actual gin route path /rotation/templates. All five annotations were corrected and the OpenAPI spec was regenerated.
Audit Logging Missing on Secret Link Operations — CreateSecretLink and DeleteSecretLink handlers now emit SECRET_LINK_CREATED and SECRET_LINK_DELETED audit log entries with the correct resource type, ID, and caller IP.

Database Migrations¶

000167_secret_integration_links_pull_tracking — Adds last_pulled_at TIMESTAMPTZ, link_purpose VARCHAR(64), and external_secret_path VARCHAR(512) columns to secret_integration_links. Includes a unique constraint uq_sil_secret_integration and a partial index for active links.
000168_rotation_config_templates — Adds the rotation_config_templates table with full CRUD columns (name, description, org scope, default flag, rotation interval, lead days, retention days, retry policy, timeout). Adds template_id UUID REFERENCES rotation_config_templates to rotation_configs.

Version 1.0.49¶

Release Date: 2026-06-20

New Features¶

Domain Control Validation (DCV) for External CA Orders — External CA providers (DigiCert CertCentral v2, SSLMarket) that require domain ownership proof before issuing a certificate now have full DCV lifecycle support. A new certificate_dcv_tokens table (migration 000166) stores per-domain challenge tokens. The backend automatically fetches tokens after order submission, transitions the renewal queue item to pending_dcv, and polls every 5 minutes. The frontend DCVStatusPanel component shows per-domain challenge details (DNS TXT record name/value, HTTP file path/content, or approver email) with copy-to-clipboard buttons, a progress bar, and a manual Retry Verification action. New API endpoints GET /api/v1/renewal-queue/{id}/dcv and POST /api/v1/renewal-queue/{id}/dcv/retry expose the DCV state with RBAC (certificate:read / certificate:write).
ADCS Pending-Approval — Non-Blocking DCOM Submission — The ADCS DCOM method no longer blocks the HTTP handler goroutine with a 5 × 5 s retry loop when the CA manager has not yet approved a request (ADCS status 5). It now returns ErrADCSPendingApproval immediately; the existing ADCSApprovalPoller background job handles asynchronous retrieval once the request is approved.
Certificate Request — Advanced Subject DN Fields — The Request Certificate modal now exposes optional Subject DN fields: Organisation (O), Organisational Unit (OU), Locality (L), State/Province (ST), and Country (C). Populated values are sent as a structured requested_subject object in the CSR request payload.
Certificate Request — Key Algorithm Override — For MazeVault-generated key pairs, operators can now override the key algorithm (RSA, ECDSA, Ed25519) and key size directly in the Request Certificate modal. The selection is sent as requested_key_algorithm and requested_key_size in the CSR payload.
Actionable Rotations Dashboard Panel — The Overview dashboard now includes a dedicated "Rotation operations" panel that surfaces overdue and failed rotation resources requiring immediate attention. Each item shows kind, project, and status badge, and supports a one-click Dismiss flow with audit note. Up to five items are shown, prioritized by age (overdue) and recency (failed).
Dashboard Expiring Certificates — 30-Day Filter — The "Direct actions" section of the Overview dashboard now filters expiring certificates to the next 30 days, making the list immediately actionable instead of showing all future expiries. The section is titled "Expiring certificates (next 30 days)". The GET /api/v1/dashboard/certificates/expiring endpoint accepts a new optional days query parameter (1–3650) to scope results; omitting it returns all future-expiring certificates (backward-compatible).
Entra Credential Staged Rotation and Dry-Run — Entra credential rotation now supports staged rotation (staged_rotation_enabled) with a configurable soak window (soak_window_hours). Both fields are persisted in the rotation resource metadata and round-trip correctly through the rotation config GET/PUT cycle. A dry-run path validates the rotation workflow against the live Entra tenant without applying any changes.
Entra Integration — Instance ID and Protocol Versioning — Entra integrations now carry an instance identifier and a protocol version field, enabling more precise targeting and future compatibility in multi-tenant and delegated execution scenarios.
Rotation Scheduler — Stuck-Item Recovery — The rotation scheduler now detects resources stuck in a running or approval-pending state beyond a configurable deadline and resets them to a retriable state, preventing silent indefinite stalls. Renewal orchestration also gained explicit coordination logic for resources transitioning through the renewal window.
Certificate Rotation — Next Due Date Calculation — Certificate rotation due-date logic is now covered by dedicated unit tests. The next due date is computed from effective lead-day policy across certificate, template, and CA-account layers, ensuring consistent renewal window behavior.

Improvements¶

Dashboard Data Fetching Resilience — Dashboard data fetching now uses Promise.allSettled instead of Promise.all. Individual widget failures (network error, 401, 404) no longer discard data from all other widgets. Each failure is logged via the structured logger for observability.
RBAC Permissions for Rotation Endpoints — Rotation resource read and write permissions are now consistently applied across all new dashboard and rotation endpoints, including archived-resource filtering in service-layer queries.
Dashboard Service Archived Resource Exclusion — Platform rotation summary and actionable rotation queries now explicitly exclude archived resources, preventing historical data from inflating overdue or failed counts.

Bug Fixes¶

Entra Rotation Config Edit — Disabled State Regression — Editing an existing Entra credential rotation configuration no longer shows all fields as disabled for non-primary credentials. The GET response now returns rotation_enabled from the stored user preference (metadata.rotation_enabled) instead of from the scheduler gate (resource.Enabled = RotationEnabled && IsPrimary), which was always false for non-primary credentials.
Entra Rotation Config — Staged Fields Not Restored on Edit — staged_rotation_enabled and soak_window_hours are now included in the rotation resource projector metadata and are therefore correctly restored when opening an existing rotation configuration for editing.
Entra Scope Binding — Tenant ID Not Required — Creating an Entra scope binding no longer requires tenant_id when the integration uses managed identity authentication. The backend validation and the frontend wizard were updated to treat tenant_id as optional for managed identity flows.

Infrastructure¶

Step-CA Network Policy — Added network policy rule to allow inbound traffic to Step-CA on port 9000 from within the cluster, unblocking staging ACME issuance flows that route through the internal Step-CA provisioner.

Version 1.0.48¶

Release Date: 2026-06-16

New Features¶

PFX Compatibility Profile Options — Certificate PFX export now supports selecting a compatibility profile (legacy / modern) that controls the encryption and MAC algorithms used in the PKCS#12 container. legacy targets OpenSSL 1.x, Java KeyStore tooling, and older Windows endpoints; modern targets OpenSSL 3.x, .NET 6+, and current Go runtimes.

Improvements¶

Log Redaction — Original Request URL Preserved — The log redaction middleware now preserves the original RequestURI on the Gin context before any path rewriting or normalization occurs. This ensures audit and structured log entries reflect the URL the client actually sent, not a post-processing artifact. A regression test covers the URL-preservation contract.
Binary Download — ArrayBuffer and Delayed URL Revocation — Certificate and agent binary downloads now use arraybuffer response type and delay object URL revocation until the download has been reliably delivered to the browser, eliminating a race condition on slow connections where the revocation fired before the download completed.

Dependency Updates¶

form-data and hasown — Updated form-data and hasown to their latest patch releases, resolving minor compatibility warnings with current Node.js runtimes.

Version 1.0.47¶

Release Date: 2026-06-14

New Features¶

Shared Entra Rollout Actions and Readiness Checks — Entra credential rotation now supports ordered rollout actions through the shared rotation platform, including Azure Key Vault, Kubernetes Secrets, agent-managed runtime files, Spring refresh/webhook delivery, and IIS app pool recycle on Windows targets. Dry-run and preflight checks validate the same runtime paths before production execution.
Per-Certificate Renewal Key Policy — Certificate operators can now choose per certificate whether renewal regenerates a new private key or reuses the existing key material where the provider and custody path allow it. Target processing order is now preserved explicitly in the renewal workflow.
Stronger Entra Integration Authentication Validation — The integration wizard and backend now validate interactive and background Entra authentication settings together, preventing save-time acceptance of configurations that cannot support background sync, dry-run, or post-rotation execution.

Improvements¶

Unified Rotation Readiness in the Project Hub — The Project Rotations view now shows inline readiness and preflight state for Entra credentials, certificate renewal resources, and certificate deployment resources, including clearer manual review required surfacing for rollout targets that cannot be probed automatically.
Role and Contract Alignment for Rotation Operations — RBAC migrations and project-surface permission checks were aligned with the expanded rotation and configuration surfaces, reducing cases where operators could open a screen without the permissions needed to complete the workflow.
Swagger and Operational Signal Refresh — Generated Swagger output now reflects the updated severity vocabulary and improved host handling, while certificate and database health checks expose stronger diagnostics for rotation readiness and export paths.
Secret Rotation API Contract Refresh — The secret rotation API and generated Swagger now document the explicit create/edit/delete lifecycle more accurately, including persisted post-rotation actions and the clean reset path after a secret rotation is removed.

Bug Fixes¶

Entra Lifecycle Cleanup Consistency — Deleting an Entra integration or a locally managed app registration now removes associated Entra credential rotation resources in the same lifecycle operation. Upgrade migration 000155 also removes historical orphan rows, and repository reads defensively hide stale entra_credential entries that predate the cleanup.
Certificate Rotation Defaults on Import — When an imported certificate is eligible for managed renewal, MazeVault now prepares the rotation configuration without silently enabling it. Initial lead days are resolved from the effective certificate, template, and CA-account policy instead of being masked by the model default.
Rollout Validation and Export Robustness — Validation for agent_id versus direct agent_url rollout steps is stricter, and certificate export flows now return clearer PFX and private-key failures instead of partially masked errors.
Secret Rotation Delete and Recreate Semantics — Deleting a secret rotation now removes the rotation config, canonical secret rotation resource, and linked rotation integrations without deleting the secret itself. After deletion, secret status surfaces show Rotation not configured, and reopening the rotation modal stays in create mode until the operator explicitly saves a new configuration.

Version 1.0.46¶

Release Date: 2026-06-09

New Features¶

External CA Order Poller Baseline — MazeVault added background polling for externally issued certificate orders, allowing asynchronous CA workflows to complete and update the certificate lifecycle without manual tracking.

Notes¶

Release Note Clarification — The Entra rotation rollout, certificate rotation UI unification, and related readiness and preflight work that had previously been drafted for v1.0.46 landed after the tag and are therefore documented under v1.0.47.

Version 1.0.45¶

Release Date: 2026-06-09

New Features¶

Rotation Resource Registry and Platform Ownership Expansion — The rotation platform is expanding from certificate-only orchestration into a registry-backed resource model. New control-plane services introduce resource kinds, target registries, and shared ownership for rotation scheduling, making future secret, certificate, and Entra rotation flows converge on the same platform primitives.
Agent Discovery Policy Bundles and Persistent Config Indexing — Agents now receive backend-driven discovery policy bundles built from active configuration templates. Filesystem discovery persists a local metadata index and reuses cached config and certificate findings across runs, reducing repeated scans while keeping policy-version changes authoritative.
Configuration Discovery Submission — Agents can now submit configuration discovery findings back to the backend, including classification and rewrite-plan metadata, using the existing discovery result model.
Certificate Template Code Deduplication and Conflict Resolution — Organization certificate template management now deduplicates template codes and blocks ambiguous conflicts. Upgrade migrations normalize existing duplicates so template routing and issuance remain deterministic.
System Certificate Classification — Certificates now carry an is_system flag for internal mTLS and identity-management material. MazeVault can retain these certificates for platform use while keeping them separate from normal operator-facing inventory.
Integration Groups — Projects now support named integration groups that map logical groupings to integration targets with structured JSONB configuration. Groups can be created, listed, updated, and deleted via the new /api/v1/projects/{id}/integration-groups and /api/v1/integration-groups/{id} API endpoints (migration 000152).
Real Slack Incident Notifications — Incident management now dispatches real-time Slack notifications via a configured Incoming Webhook. When an incident is raised on a project with a Slack integration, the platform posts the incident type and resource name to the configured channel.
GCP Secret Manager and Kubernetes Connectivity Tests — Integration health checks now validate live GCP Secret Manager API access (listing secrets in a given project) and Kubernetes API server reachability using in-cluster or kubeconfig credentials, in addition to the existing provider tests.
HSM Key Operations — HSM providers (PKCS#11, AWS CloudHSM, GCP Cloud HSM, Azure Managed HSM) now expose full key lifecycle operations: GetPublicKey (reconstructs RSA/EC PKIX DER from hardware), DeleteKey (destroys all key objects on the device), ListKeys (enumerates all managed key handles), and GetKeyInfo (returns key type, size, and extractable flag).
Vault PKI Full Lifecycle — HashiCorp Vault CA provider now implements the complete CA interface: RenewCertificate, GetCertificateStatus (checks revocation timestamp), ListIssuedCertificates (enumerates via PKI list endpoint), GetOrderStatus, and CancelOrder (revokes the underlying certificate).
ADCS Deferred Certificate Retrieval — The ADCS (WCCE) provider now fetches certificates that were issued asynchronously by the CA via a SOAP Renew request. Previously pending certificates are retrieved and returned in PEM format once the CA completes issuance.
Venafi VaaS Full Lifecycle — Venafi CA provider now implements RenewCertificate, GetOrderStatus (retrieves pick-up status from VaaS), and CancelOrder.
DigiCert Rate Limit Reporting — The DigiCert provider now queries live rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) and surfaces them through the GetRateLimits interface.
Config Injection with Live Secret Values — Configuration versioning now resolves ${VAULT:<placeholder>} tokens against live MazeVault secret values at snapshot time, so injected config files carry real credentials without storing them in the config version history.

Improvements¶

Project-Aware Resource Visibility Policies — Azure discovery endpoints now apply resource_visibility_policy filtering in the context of the selected project. This keeps Integration Wizard choices aligned with project scope for non-admin operators instead of exposing subscription-wide results.
Configuration Management Auditability — Configuration management flows now record audit-aware rewrite-plan activity so operational changes are traceable alongside the rest of the platform's lifecycle events.
Generated CSR and Key Custody Metadata — Certificate request flows now carry generated-CSR and private-key custody metadata forward, improving visibility of whether MazeVault owns, reuses, or must preserve external key material in subsequent lifecycle actions.
Delegated Agent Secret Sync Step — Rotation and execution pipelines now have an explicit agent-side secret synchronization step, improving parity between platform orchestration and what managed agents actually apply downstream.
Certificate Owner-Surface Navigation — Certificate links from the main dashboard, project rotations, and the certificate inventory now resolve directly to the owning surface. Project-owned certificates open their project detail view, while unassigned inventory opens the Discovered Certificates owner surface via managed_certificate_id, replacing the legacy duplicate /certificates flow.
Secret Dashboard Data Consistency — The Secrets Overview tab now uses the shared dashboard API, restoring missing-secret drill-ins and keeping overview counts and decrypted names aligned with the main dashboard data layer.
Discovered Certificate Lookup Filter — Discovery APIs and generated Swagger documentation now support managed_certificate_id filtering, enabling targeted deep links from certificate overview tables to the matching discovered certificate record.

Bug Fixes¶

Rotation Scheduling Ownership Cutover — Renewal scheduling is moving to the shared rotation platform owner model so follow-up workflows operate on the current certificate resource instead of stale pre-renewal anchors.
Discovery Project Context Consistency — Integration discovery helpers now consistently pass project context, avoiding empty or over-broad Azure discovery responses when resource visibility filtering is enabled.
Detect Drift Authentication — POST /api/v1/secrets/drift/detect now executes inside the authenticated secrets route group, fixing 401 failures caused by missing auth context on drift-detection requests.
Dashboard Drill-In Regressions — Fixed stale certificate links that still pointed to the removed global certificates page and restored missing-secret links in the Secrets Dashboard overview.

Version 1.0.44¶

Release Date: 2026-05-25

New Features¶

Certificate Rotation Post-Actions — Certificate rotation now supports explicit post-rotation action chains, including webhooks and other registered post-processing steps, so operators can trigger downstream refresh and rollout workflows after a successful renewal or deployment.
Delegated Renewal and Rotation Publish Controls — Renewal orchestration gained delegated execution paths, runtime probes, and publish-gate safeguards that better separate readiness validation from side-effecting deployment work.
Archive Center Lifecycle Enforcement — Archive restore and permanent delete flows are now treated as centralized archive-lifecycle operations with admin-only enforcement across runtime RBAC and role editing.
Expanded Agent Binary Coverage — MazeVault agent distribution now includes additional ARM64 coverage and stronger build validation for heterogeneous Windows and Linux estates.

Improvements¶

Discovered Certificate Key Custody Tracking — Adopted discovered certificates now preserve explicit key-custody state, preventing MazeVault from silently taking ownership of private keys during renewal or deployment flows.
Certificate Issuance and Renewal Robustness — Certificate issuance, CSR handling, and renewal flows now use stronger locking, normalized post-action payloads, and clearer actor attribution across cross-project secret operations.
CA Account Provider Coverage — CA account and EAB credential handling now covers more provider initialization paths, including Smallstep-specific fallback fields used during account creation and validation.

Bug Fixes¶

Smallstep CA Account Initialization — Smallstep CA account creation now correctly falls back to credential fields such as server_url and provisioner metadata instead of failing before contacting the CA.
Rotation Action Contract Alignment — Certificate post-action handling now exposes only action types supported by the certificate rotation executor, avoiding invalid UI selections and mismatched step names.

Version 1.0.43¶

Release Date: 2026-05-11

New Features¶

Azure Key Vault Managed Identity Support — Azure Key Vault integrations now support Managed Identity and Workload Identity as authentication methods in addition to service principals. When Azure Key Vault is selected in the Integration Wizard, the background sync auth method defaults to managed_identity. Configure a specific managed identity client ID via AZURE_MANAGED_IDENTITY_CLIENT_ID, or leave it unset to let the platform resolve the bound identity from the environment (AZURE_FEDERATED_TOKEN_FILE + AZURE_CLIENT_ID + AZURE_TENANT_ID for workload identity).
Agent Systemd Service Installation — The agent installer script now deploys the MazeVault agent as a proper systemd service. A dedicated mazevault-agent system user is created automatically, and locked-down directories are provisioned (/etc/mazevault, /var/lib/mazevault, /var/log/mazevault) with ownership and permissions (0750). The service is configured with automatic restart on failure. Existing deployments should re-run the deployment script to receive the updated service unit.
Agent Binary Download Endpoint — A new deployment-scoped endpoint GET /deployments/:id/agent-binary serves the agent binary for a given deployment. The deployment UUID acts as the authentication token (unguessable 128-bit identifier), consistent with the /script and /config endpoints. Legacy agent binary download rewrite rules in the reverse proxy have been removed.
Redis Multi-Endpoint Support — Redis connection handling now supports multiple endpoint addresses for high-availability and fallback setups. Configure the primary endpoint via REDIS_URL and one or more fallback addresses via REDIS_FALLBACK_URLS (comma, semicolon, or newline-separated). The client automatically falls back to the next available endpoint on connection failure, and switches to an in-memory fallback if all Redis endpoints are unavailable.
Password Complexity Policy in Organization Settings — Organization Settings now exposes a dedicated Password Complexity Policy editor. Rules are enforced at password change time (minimum length, character class requirements, history depth). On upgrade, organizations are automatically migrated from the legacy secret_complexity_policy field.

Improvements¶

Entra Credential Rotation History — Entra ID credential rotation operations now produce a persistent rotation history record for each event. The history captures the rotation type, old and new key identifiers, workflow and execution IDs, step-by-step progress, final status, error details if applicable, and elapsed duration. This enables full lifecycle traceability for Entra credential rotations.
RBAC Permission Alignment — Role permissions updated to match the agreed product policy:
- secret_manager — gains keytab:read and config:read (KeyTab Management and Configuration Management pages are now accessible)
- certificate_manager — gains config:read (Configuration Management page is now accessible)
- auditor — keytab:read removed (KeyTab Management is no longer visible to auditors; assign explicit keytab:read where audit access to keytabs is required)
Admin Credential Reference Types Expanded — Database admin credentials now support two additional reference types: mazevault (credentials stored as MazeVault-managed secrets) and external (generic external references). Full set of supported types: internal, mazevault, external, keyvault, aws_sm.
Secret Sync Async Seeding with Status Summary — Sync seed operations now run asynchronously and return immediately with a progress reference and detailed status summary (secrets created, updated, skipped, failed). Blocked seed incidents are now surfaced on the Conflict Resolution page.
Certificate Issuance Linked to Agent — Certificates issued to a registered agent are now linked to the issuing agent record at issuance time, connecting the certificate lifecycle to the agent in the dashboard and rotation orchestration.
Security Enhancements — Bootstrap and KeyTab Handlers — KeyTab update and delete handlers now enforce organization ownership checks (IDOR prevention): access to a keytab belonging to a different organization returns 404. The bootstrap password change endpoint is locked after initial bootstrap completes and rejects further calls with 403 Forbidden. A DAST scan workflow has been added to the CI pipeline.
License Renewal Contact Updated — The license renewal contact email is now info@mazevault.com across all notification banners and expiry modals.

Bug Fixes¶

SSO Provider Modal: Provider ID Preserved on Save — Fixed a bug where saving an existing SSO provider configuration dropped the provider ID, causing duplicate provider creation on subsequent saves.
Password Complexity Policy Backfill — Organizations that had configured a secret complexity policy via the legacy secret_complexity_policy field were incorrectly evaluated as having no password policy, causing false-positive PCI-DSS 8.3 compliance failures. The policy is now automatically propagated to the dedicated password complexity field on upgrade. Additionally, organizations without any complexity policy now receive a secure default policy on upgrade (16-character minimum, all character classes required, 10-entry history, 30-day rotation interval).

Version 1.0.42¶

Release Date: 2026-05-11

New Features¶

Certificate Metadata Fields — Certificates now support three user-editable metadata fields accessible from the certificate detail view and via PUT /api/v1/certificates/:id:
- Tags — Free-form string labels for grouping and filtering certificates. Tags set at import time are now persisted and remain editable after import. Send an empty array to clear all tags.
- Documentation URL — Optional link (http/https) to external documentation, runbooks, or CMDB entries for the certificate. Maximum 500 characters.
- Notes — Short free-text annotation (maximum 256 characters). Send an empty string to delete the note.
- All metadata field changes are recorded in the audit log.

Improvements¶

Environment Canonicalization Enforced at Task Creation — Gateway task creation now enforces environment slug canonicalization. All gateway tasks are stored with lowercase environment slugs regardless of caller casing, building on the canonicalization infrastructure introduced in v1.0.41. The MAZEVAULT_ENV_CANONICAL_ENFORCE variable (set to true to fail-close on non-canonical inputs) applies to task creation as of this release.

Version 1.0.41¶

Release Date: 2026-04-26

Improvements¶

Documentation Sync — Comprehensive documentation update aligned with v1.0.41 codebase. Environment variable reference expanded with five new sections: License/Organization Registration, Orchestrator Mode, ACME DNS-01, KeyTab Management, and Agent Binary Proxy. All existing sections updated with previously missing variables.
Office 365 Email Variable Corrected — Fixed incorrect variable name O365_ENABLED → O365_EMAIL_ENABLED throughout documentation. Full Office 365 authentication configuration documented (client secret, certificate, and managed identity methods).
KeyTab API Reference — Full API documentation published for all 14 KeyTab management endpoints. See KeyTab API.
Reports API Reference — Full API documentation published for the Weekly Expiry Reports endpoints. See Reports API.
Platform Version Sync — All documentation pages updated to reflect current platform version.

Version 1.0.40¶

Release Date: 2026-04-25

New Features¶

OIDC Nonce Enforcement — New MAZEVAULT_ENFORCE_OIDC_NONCE flag enables strict nonce validation on OIDC tokens. When set to true, tokens without a valid nonce claim are rejected, providing protection against token replay attacks. Recommended for all production deployments.
Agent Trust Store Controls — New environment variables MAZEVAULT_AGENT_INSTALL_CHAIN_TO_TRUSTSTORE and MAZEVAULT_AGENT_TRUST_STORE_PATH control whether the MazeVault agent installs the internal CA certificate chain into the operating system trust store, and allow overriding the default trust store path on Linux.

Improvements¶

Certificate Rotation Target Sync Status — GET /api/v1/certificates/:id/targets/:targetId/status now returns full per-step result details, making failed target synchronizations easier to diagnose.
Gateway Registration Stability — Improved retry logic for bootstrap token exchange reduces failed registrations caused by transient network issues during first-time gateway setup.
OCSP URL Validation — OCSP_URL backend variable now validates URL format at startup to prevent misconfiguration from silently causing OCSP failures.

Bug Fixes¶

Corrected AGENT_VERSION=latest resolution to always fetch the highest tagged release version rather than the most recent commit.
Fixed display overlap in the certificate import modal under Orchestrator Mode when both keytab and private key sections were visible simultaneously.

Version 1.0.39¶

Release Date: 2026-04-22

New Features¶

Agent Binary Distribution Control — New configuration variables provide granular control over how agent updates are distributed across the fleet. AGENT_ROLLOUT_PERCENTAGE limits what percentage of agents receive update notifications (0–100), enabling staged rollouts. AGENT_MAX_CONCURRENT_DOWNLOADS caps parallel binary download streams to prevent network saturation.
Agent Binary Proxy — MazeVault can now proxy agent binary downloads from a private GitHub release repository, removing the requirement for agent hosts to reach the public GitHub Releases endpoint directly. Configure via AGENT_BINARY_GITHUB_TOKEN, AGENT_BINARY_CACHE_DIR, AGENT_DOWNLOAD_BASE_URL, and AGENT_VERSION.
Primary Backend Environment Seeding — New MAZEVAULT_PRIMARY_ENVIRONMENTS variable pre-seeds the list of environments served directly by the primary backend on first startup, simplifying initial deployment configuration of multi-environment setups.

Improvements¶

KeyTab Dashboard Refresh — Fixed cipher compliance breakdown chart not updating after importing a keytab with deprecated ciphers.
Weekly Report Multi-Channel Reliability — Resolved a scheduling race condition that could silently drop one delivery channel when multiple channels were all enabled simultaneously.

Bug Fixes¶

Fixed gateway heartbeat timestamp not updating correctly following a network partition recovery.

Version 1.0.38¶

Release Date: 2026-04-19

New Features¶

KeyTab Management — Full Kerberos Lifecycle — Enterprise-grade Kerberos KeyTab management with complete lifecycle support. Import, discover, and manage keytab files across your infrastructure. Key capabilities include:
- Import & Parse — Import MIT Kerberos v2 keytab binary files with automatic extraction of principals, realms, key version numbers (KVNO), and encryption types. Supports base64-encoded upload.
- Agent Discovery — Agents automatically discover .keytab files on managed hosts, reporting file path, permissions, owner, and encryption type fingerprint. Discovered keytabs can be imported into managed inventory with a single action.
- Cipher Policy Enforcement — Define organization-level cipher policies specifying allowed and deprecated Kerberos encryption types. Three enforcement modes: audit (report only), warn (allow with warning), block (prevent non-compliant keytabs). Default policy blocks legacy ciphers (DES, RC4-HMAC) while allowing modern AES and Camellia ciphers.
- Version History — All keytab updates create immutable version records with change reason tracking for full audit compliance.
- Dashboard & Analytics — Dedicated KeyTab dashboard showing total/active/expired counts, cipher compliance breakdown (compliant/warning/critical), expiry forecasts, and cipher type distribution.
- Orchestrator Mode Support — In Orchestrator Mode, keytab binary data is offloaded to an external provider; only metadata is stored locally.
Weekly Expiry Report — Automated weekly reports showing certificates and secrets expiring within 60 days, delivered to multiple channels simultaneously:
- Email — HTML-formatted report to configured recipient list
- Slack / Microsoft Teams — Webhook-based notifications with expiry summaries
- JIRA — Automatic issue creation with expiry details for tracking
- Generic Webhook — HTTP POST with full report payload for custom integrations
- Reports can be previewed before sending and triggered manually on demand.
Local Gateway Registration — The primary backend can now register itself as a local gateway, enabling unified gateway management UI for both local and remote gateways. A unique constraint ensures only one local gateway per deployment.

Improvements¶

Gateway Multi-Environment Support — Gateways can now serve multiple environments simultaneously, removing the previous one-gateway-per-environment restriction.
Report RBAC Permissions — New report:read and report:write permissions provide fine-grained access control for the reporting system. All standard roles (User, Certificate Manager, Secret Manager, Auditor) receive report:read; Admin and Project Admin additionally receive report:write.
KeyTab RBAC Permissions — New keytab:read, keytab:write, keytab:delete, and keytab:admin permissions control access to keytab management. Standard users and auditors receive read access; operators and organization admins receive write and delete; organization admins additionally receive admin access for policy management.

Bug Fixes¶

Entra Sync Rule Cleanup — Removed orphaned sync rules left behind by deleted integrations, and cleaned up duplicate sync rules for entra_id provider type (now handled by the dedicated Entra Sync Scheduler). Fixes recurring "sync failed for rule" errors in production environments.

Version 1.0.37¶

Release Date: 2026-04-16

Improvements¶

Gateway Task Payload Encryption — Sensitive task payloads exchanged between the primary backend and gateways are now encrypted at rest in the database. The payload_encrypted flag on gateway tasks ensures that JSONB payloads containing credentials and private keys are protected even if database access is compromised.
Write Queue Exponential Backoff — Multi-datacenter write queue now tracks the timestamp of each retry attempt, enabling proper exponential backoff calculation for failed synchronization operations. This improves reliability and reduces unnecessary load on remote gateways during connectivity disruptions.

Security Updates¶

Gateway Payload At-Rest Encryption — Task results and payloads in the gateway task queue are now encrypted before database storage, closing a potential data exposure vector in multi-datacenter deployments.

Version 1.0.36¶

Release Date: 2026-04-15

New Features¶

KeyTab Database Schema — New database tables for keytab management: keytabs (encrypted keytab storage with cipher compliance tracking), keytab_versions (immutable version history), keytab_cipher_policies (organization-level cipher enforcement), and discovered_keytabs (agent discovery results with stale detection).
KeyTab RBAC Permissions — New permission set (keytab:read, keytab:write, keytab:delete, keytab:admin) assigned to appropriate system roles for keytab lifecycle management.

Improvements¶

Gateway API Token Enhancement — Improved gateway authentication with dedicated API tokens and bootstrap provisioning support.
Agent KeyTab Discovery — Agents can now discover Kerberos keytab files on managed hosts and report findings including file path, permissions, owner, encryption types, and SHA-256 fingerprint.

Version 1.0.35¶

Release Date: 2026-04-14

Bug Fixes¶

PEM Import — Private Key Preservation — Fixed a critical issue where importing a PEM file containing a certificate chain and a private key would silently discard the private key. The system correctly detected the key during file preview but lost it during the actual import, causing subsequent PFX/JKS exports to fail. The PEM bundle parser now correctly extracts PKCS#8, RSA, and EC private key blocks.
Certificate Import — Project Name in Error Messages — When importing a certificate that already exists, the error message now includes the project name where the duplicate resides (e.g., "certificate already exists … project=MyProject"), making it easier to identify conflicts.

Improvements¶

Private Key Visibility in UI — Certificates now display their private key status across all views:
- Certificate lists show a green shield icon when a private key is stored.
- The certificate dashboard shows a green key icon next to certificates with private keys.
- The certificate detail modal displays a chip indicating whether the key is stored locally, externally, or not available.

Version 1.0.34¶

Release Date: 2026-04-10

New Features¶

Identity Provider Group Discovery — New API endpoint GET /identity-providers/{id}/groups fetches groups directly from the configured identity provider (Entra ID via Microsoft Graph, LDAP via directory search). Supports search filtering by group display name for easy role mapping.
Identity Provider Test Coverage — Added comprehensive unit test coverage for identity provider CRUD operations, test-connection flow, and group discovery endpoints.

Improvements¶

JKS Export — Pure Go Implementation — Replaced the external keytool (JDK) dependency with a native Go implementation using keystore-go/v4. JKS export now works in any environment without requiring a Java runtime, includes the full certificate chain, and has comprehensive test coverage.
Gateway API Token Authentication — New gateway_api_tokens table and middleware for gateway-to-backend API authentication. Gateways can now authenticate using dedicated API tokens with automatic bootstrap provisioning.
Gateway Write Queue — Added gateway_write_queue table for buffering write operations from gateways, enabling reliable data synchronization in multi-datacenter deployments.
Gateway Bootstrap Hardening — Improved gateway bootstrap flow with enhanced validation, Azure SQL connectivity checks, and more reliable initial registration.
Azure Test Environment Terraform — New Terraform configuration for automated Azure test environment provisioning, including Entra ID enterprise apps, Key Vaults, and Azure SQL.

Security Updates¶

Gateway Middleware Authentication — New dedicated middleware validates gateway API tokens with proper scope checks and request context propagation.

Version 1.0.33¶

Release Date: 2026-04-09

New Features¶

Azure Permissions Check Endpoints — Added new Azure access validation APIs for permissions and resource visibility:
POST /api/v1/admin/azure/mi-permissions-check
GET /api/v1/azure/user-permissions-summary
GET /api/v1/azure/subscriptions/{subscriptionId}/sql-servers
Managed Identity Permissions Validation — New managed identity check flow validates access across configured Azure integrations and returns per-integration status results.
User Permissions Summary — Added a consolidated subscription-level overview of Azure resources visible to the authenticated user, including Key Vault and SQL server discovery.

Improvements¶

RBAC Integration for Azure Permission Checks — Azure permissions endpoints are now protected by MazeVault RBAC with integration:read and integration:write guards.
Swagger Schema Coverage — OpenAPI definitions now include the Azure permissions check response models (MIPermissionsCheckResponse, MICheckResult) for accurate API client generation.

Security Updates¶

Role Permission Alignment — Migration 000109_add_audit_settings_permissions adds audit:read and project:write permissions to certificate_manager and secret_manager roles for consistent access control behavior.

Version 1.0.32¶

Release Date: 2026-04-08

New Features¶

Azure Managed HSM Integration — Full support for key storage and manipulation in Azure Managed HSM with automatic certificate updates and key rotation. All private key operations occur in the HSM with metadata returned to the database.
Organization-Level Password Policy — Define password enforcement rules (minimum length, complexity, expiry) for all organization users. Rules are enforced at password creation and change with legacy integration compatibility.

Improvements¶

CRDT Sync Performance — Optimized conflict resolution for datasets >100k records, 40% speed improvement on multi-DC setups.
Extended Audit Logs — Comprehensive recording of all password, certificate, and administrative operations.

Bug Fixes¶

Fixed cache invalidation timing in cluster deployments.
Resolved sync failures with large CSR transactions.

Version 1.0.31¶

Release Date: 2026-04-07

New Features¶

Orchestrator Mode — External Key Storage — MazeVault can now run in a mode where all private keys and secrets are stored exclusively in external key vaults (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault). Local database contains only metadata.
License Compliance Tracking — Dashboard displays license status in real-time, including used licenses, upcoming expirations, and warning states.

Improvements¶

Standard → Orchestrator Mode Migration — New CLI commands for safely migrating existing Standard mode systems to Orchestrator mode.
Orchestrator Mode UI — Toggle in Onboarding Wizard and organization settings.

Bug Fixes¶

Fixed selective certificate copying in Orchestrator mode.

Version 1.0.30¶

Release Date: 2026-04-07

New Features¶

ACME Server — Full RFC 8555 Implementation — MazeVault now acts as a fully compliant ACME certificate authority. Any standard ACME client (cert-manager, Certbot, acme.sh, Kubernetes) can obtain and renew certificates directly from MazeVault without manual intervention. Supported challenge types: HTTP-01, DNS-01, TLS-ALPN-01.
External Account Binding (EAB) — Restrict ACME account registration to authorized clients using pre-shared EAB credentials (HMAC-based). Prevents unauthorized certificate issuance from unknown ACME clients.
Sync Dashboard — New dashboard section showing real-time synchronization status: configuration overview, active conflicts, and sync failures with per-item resolution guidance.
Sync Read Permission — New sync:read permission grants project members, auditors, and role holders access to sync status endpoints without requiring elevated privileges.

Improvements¶

ACME Authorization Nonce Hardening — Dedicated nonce table (acme_server_nonces) with TTL-based expiry ensures strict replay-nonce protection per RFC 8555 §6.5.
ACME Challenge Token Indexing — Challenge tokens now use a dedicated indexed column for O(1) validation lookups instead of JSON scanning, improving throughput under high ACME request volume.
RBAC — Sync Permissions Aligned — project_admin, certificate_manager, secret_manager, user, and auditor roles now include sync:read for consistent access to sync dashboard endpoints.

Bug Fixes¶

Fixed race condition in ACME order state transitions during concurrent finalize requests.
Resolved ACME authz table creation ordering issue (migration idempotency).

Version 1.0.29¶

Release Date: 2026-04-06

New Features¶

Configuration Management Interface — New multi-tab UI for lifecycle management of configuration files: discover YAML/JSON/INI files across environments, stage drafts, and promote configurations to production. Provides visibility into discovered vs. managed configuration counts.
Certificate Rotation Polymorphic Config — Rotation executions now support both secret and certificate rotation configs in a unified model. The config_type field distinguishes between the two, eliminating separate workflow tables.
Rotation Settings Source Tracking — Each certificate now records whether its renewal settings originate from a project template (template) or were manually configured (manual), providing clear audit attribution for rotation behavior.

Improvements¶

Organization Scoping for Certificate Requests — Certificate signing requests (CSRs) are now scoped to the originating organization. The organization_id field is backfilled from project associations, preventing cross-organization CSR data leakage.
ACME Server Authorization Tables — Database schema for the ACME server protocol (authorization objects and nonce tables) was provisioned in preparation for the v1.0.30 ACME server release.
Rotation Workflow Cleanup — Removed orphaned rotation_workflows and rotation_step_executions tables that were superseded by the unified rotation execution model.

Bug Fixes¶

Fixed rotation_configs.next_rotation column rename to next_rotation_at — scheduler queries now use the correct column name.
Resolved foreign key constraint on rotation_executions.config_id that prevented polymorphic rotation config references.

Version 1.0.28¶

Release Date: 2026-04-05

New Features¶

Secret Naming Policies — Define organization-wide naming conventions for secrets using regex-based rules with three enforcement levels: block (prevent creation), warn (allow with warning), and disabled (informational). Policies are managed as configuration templates and validated in real-time on secret creation.
Naming Compliance Dashboard — New tab in the Secrets Dashboard shows a policy violation heatmap, per-rule compliance rates, and auto-generated rule suggestions based on existing secret naming patterns.
Consistency Framework — Create consistency groups to verify that specified secrets exist across all required environments. The POST /projects/{id}/consistency/groups endpoint and dashboard tab surface missing values and environment gaps, with resolve-warning support for documented exceptions.
Database Security Defaults — Organizations can now configure per-environment TLS/encryption baselines for database integrations. Production environments default to strict TLS (verify-full, encrypt, TCPS); non-production environments use permissive defaults. Supported providers: Oracle, MSSQL, PostgreSQL, MongoDB, MySQL.
Enhanced Shared Secrets — Shared secrets now support optional passphrase protection (bcrypt), recipient_email for intent tracking, automatic content-type tagging (secret or certificate), and rotation source attribution (source_type, source_id) for automated post-rotation distribution.

Security Updates¶

Consistency RBAC Permissions — New consistency:read and consistency:write permissions control access to consistency groups and warning resolution. Assigned to project_admin, certificate_manager, secret_manager, user, and auditor roles.
Auditor Role Refinement — The auditor role no longer has access to the deployment dashboard or general dashboard views, focusing the role strictly on audit logs, user management, gateway status, and agent status — reducing the attack surface of read-only accounts.

Bug Fixes¶

Fixed secret naming policy storage: policies are now persisted in config_management_templates instead of the deprecated organizations.secret_complexity_policy JSONB column.

Version 1.0.27¶

Release Date: 2026-04-04

New Features¶

New Roles: Certificate Manager & Secret Manager — Two new purpose-built roles provide fine-grained access control without granting cross-domain visibility:
certificate_manager — Full lifecycle management for certificates, CA accounts, templates, discovery, and deployment. No access to secrets.
secret_manager — Full lifecycle management for secrets, rotation, deployment, and integrations. No access to certificates.
SSO Authorization Code Pattern — Access tokens are no longer passed via URL query parameters on SSO callback. The callback now delivers a short-lived opaque code (sso_code, 60-second TTL) that the frontend exchanges for tokens via POST /auth/sso/exchange. This eliminates token exposure in browser history, server access logs, and Referer headers. Applies to Entra ID, GitHub, and GitLab SSO providers.
Entra Group Mapping Consolidation — Entra ID group-to-role mappings are now stored in the unified group_role_mappings table with a source column (local or entra). This enables consistent group management across local LDAP groups and Entra ID cloud groups from a single interface.

Security Updates¶

OIDC Nonce Validation — OAuth2 state now carries a server-generated nonce validated at token exchange. Prevents CSRF/token-hijacking via cross-site OAuth state substitution.
Deprecated Roles Removed — Legacy roles (operator, developer, org_admin, secret_editor, secret_viewer, certificate_admin, system_admin) have been removed. Existing users with these roles were automatically migrated: operator → project_admin, developer → user. Integrations using deprecated role names in API calls must be updated.
User Role Data Integrity — Fixed zero-UUID primary key corruption in the user_roles table caused by a missing BeforeCreate hook. A composite unique index was added to prevent duplicate role assignments. Affected rows were deduplicated during migration.
Soft-Deleted User Email Index — The email uniqueness constraint is now a partial index (WHERE deleted_at IS NULL). Soft-deleted users no longer block new account creation or SSO registration with the same email address.

Bug Fixes¶

Fixed Entra group mapping duplication after SSO re-authentication.
Resolved role assignment failures for users created via LDAP group sync.

Version 1.0.26¶

Release Date: 2026-04-03

New Features¶

PFX/PKCS#12 Import Improvements — Enhanced PFX certificate import with improved parsing and validation
Certificate Template Fixes — Resolved template configuration issues affecting certificate enrollment workflows
Role Mapping Modifications — Updated group-to-role mapping logic for improved SSO integration
Audit Log Enhancements — Extended audit logging with additional event types and improved traceability

Security Updates¶

Comprehensive Vulnerability Remediation — Resolved 18 out of 24 identified vulnerabilities across all platform components through systematic dependency scanning and updates
SAML Signature Bypass Fix (CRITICAL) — Fixed critical SAML XML signature bypass vulnerability in SSO authentication flow (goxmldsig v1.3.0 → v1.6.0)
HTTP/2 CONTINUATION Flood Fix (CRITICAL) — Resolved actively exploitable HTTP/2 denial-of-service vulnerability in Kubernetes Operator (golang.org/x/net v0.19.0 → v0.52.0)
gRPC Authorization Bypass Fix — Fixed gRPC authorization bypass via missing leading slash in path (google.golang.org/grpc → v1.80.0)
JOSE/JWE Denial-of-Service Fixes — Resolved 3 separate DoS vulnerabilities in JSON Web Encryption handling (go-jose/v3 v3.0.0 → v3.0.4)
Node.js SDK Critical Fix — Eliminated 8 critical Handlebars.js advisories including JavaScript injection and prototype pollution
CI/CD Security Hardening — Pinned Trivy security scanner to specific version (supply chain protection), enabled security scanning on all CI events

Improvements¶

Kubernetes Operator Overhaul — Major dependency update to controller-runtime v0.22.5 and k8s.io/* v0.34.3 with code quality improvements including extracted reconciliation methods, configurable refresh intervals, proper watch propagation, and structured logging
Terraform Provider Fix — Fixed compilation error and updated all dependencies to latest stable versions (terraform-plugin-framework v1.19.0, grpc v1.80.0)
Go SDK Enhancement — Added Environment field to Project model for improved project management
Docker Image Hardening — Pinned OCSP Responder base image to alpine:3.21 (reproducible builds), switched Frontend to npm ci for deterministic dependency installation
Dependency Alignment — Aligned golang.org/x/crypto, golang.org/x/net, and other standard library packages across all 7 Go modules to latest stable versions

Version 1.0.25¶

Release Date: 2026-04-01

New Features¶

Swagger API Documentation Overhaul — Comprehensive regeneration of Swagger/OpenAPI documentation with complete endpoint coverage, improved schema definitions, and accurate request/response examples
Entra ID SSO Environment Configuration — New environment variables for Entra ID SSO and Azure Managed Identity configuration in .env.example for streamlined deployment setup

Improvements¶

LDAP & OAuth Provider Configuration — Enhanced SSO provider setup with improved LDAP bind DN handling and OAuth2 flow configuration
Email Status Endpoint — New GET /api/v1/system/email-status endpoint for monitoring email notification delivery status
Certificate Rotation Handlers — New API handlers for certificate rotation execution and status tracking
Agent Integration Enhancements — Improved agent discovery and integration handlers with better error reporting
SSH Key Management — Extended SSH key service with improved import and rotation capabilities

Security Updates¶

Updated authentication service with enhanced token validation and session management
Improved Entra ID Graph client with additional security headers

Version 1.0.24¶

Release Date: 2026-03-30

Bug Fixes¶

Entra ID SSO Fix — Resolved critical Entra ID SSO authentication issue affecting login flow and token refresh
Code Cleanup — Removed deprecated handler code and unused Entra mapping endpoints for cleaner codebase

Improvements¶

Updated schema models with additional field definitions for improved data integrity

Version 1.0.23¶

Release Date: 2026-03-30

Improvements¶

Certificate Templates and Expiry Management — Enhanced certificate template configuration with improved expiry tracking, scheduler optimizations, and better CA integration status indicators
Certificate Import Validation — Improved certificate import service with stricter chain validation and better error messages
SSLmarket CA Sync — Extended SSLmarket CA provider with improved product synchronization and certificate status tracking
Extended Logging — Enhanced logging across certificate services for better troubleshooting and audit trail

Bug Fixes¶

Fixed certificate status calculation in X.509 utility functions
Resolved certificate dashboard display issues for expiring certificates
Fixed certificate edit modal preserving incorrect values on save

Version 1.0.22¶

Release Date: 2026-03-30

New Features¶

Multi-Gateway Environment Support — New database migration and service layer for multi-gateway deployments with environment-specific gateway configuration, health monitoring, and task execution
Gateway Health Monitor — Real-time gateway health monitoring service with heartbeat tracking, automatic failover detection, and Prometheus metrics
Gateway Routing Service — Intelligent request routing across multiple gateway instances with load balancing and environment awareness
Gateway Task Executor — Distributed task execution framework for gateway operations with retry logic and status tracking
Identity Provider Management — New API handlers for identity provider configuration and management

Improvements¶

Cipher Key Resolver Hardening — Comprehensive test coverage for cipher key resolution with 715+ lines of new tests eliminating dual storage inconsistencies
Database Health Checks — Updated expected tables and columns for new gateway-related database schema
Integration Wizard — New multi-step integration wizard UI for configuring CA providers, secret managers, and external integrations
Key Derivation Fix — Resolved key derivation issue affecting encryption operations

Security Updates¶

Eliminated cipher key dual storage vulnerability via migration 000089
Enhanced authentication service with improved session handling

Bug Fixes¶

Fixed test failures in certificate orchestrator and configuration management services
Resolved EntraID SSO redirect issue on certain browser configurations

Version 1.0.21¶

Release Date: 2026-03-26

New Features¶

Azure Resource Discovery — New API handlers for Azure cloud resource discovery with Key Vault, certificate, and secret enumeration
Integration Wizard UI — Multi-step wizard for configuring integrations with CA providers and secret managers, including type selection, provider configuration, and review steps

Improvements¶

CA Account Service — Enhanced CA account management with improved error handling and status tracking
Model Schema Updates — Updated data models across SSH keys, MFA, OAuth, CRL, and zero-trust modules for improved consistency and validation
Test Coverage — Expanded test coverage for integration service providers, key offload service, and secret service offload operations

Bug Fixes¶

Fixed certificate audit event model inconsistency
Resolved discovered certificate model field alignment issues

Version 1.0.20¶

Release Date: 2026-03-23

New Features¶

Office365 OAuth2 Email Notifications — Send email notifications via Microsoft Graph API using OAuth2 client credentials flow instead of legacy SMTP; supports 3 authentication methods (client secret, certificate, managed identity); reuses existing Entra ID infrastructure with connection caching and retry logic; transparent replacement — all 6 email trigger points (expiry alerts, incidents, weekly reports, rotation failures, discovery summaries, test notifications) work automatically; new GET /api/v1/system/email-status endpoint and frontend status indicator in System Outputs → Notifications tab
SmallStep CA Provider — Integration with open-source step-ca as a Certificate Authority backend supporting JWK, X5C, and OIDC provisioners; mTLS authentication, certificate signing, renewal, revocation, and CRL signing with root fingerprint verification; ideal for zero-trust short-lived certificate architectures
Multi-Target Certificate Rotation — Deploy certificates to 5 destination types: Secret Managers (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault), Kubernetes Secrets (TLS/Opaque), Agent Keystores (JKS, PKCS12, Windows), Agent Files (PEM), and Database Wallets (Oracle OCI); content mode selection (public only, public+chain, full chain with key, key only), format auto-detection, retry policies with configurable attempts and delays, and post-install command execution
Enterprise Entra ID Credential Lifecycle — Complete lifecycle management with states (created, active, expiring, expired, revoked, grace period), configurable grace periods (default 30 days), rotation history tracking with old/new key IDs and workflow tracing, expiry monitoring dashboard, idempotency protection against duplicate rotations, and sync conflict resolution for local vs. remote state
Compliance Report Viewer — Generate and view compliance reports with template-based formatting, organization-wide certificate compliance analysis, and exportable report output
Rotation Execution History — Detailed per-certificate rotation history with execution timestamps, status tracking (success/failed/pending), and target-level sync status visualization
Certificate Lifecycle Phase Tracking — New lifecycle phases (stable, renewing, rotating, revoking) prevent duplicate CA requests during in-flight operations; orthogonal to certificate status, ensuring certificates remain valid during phase transitions

Improvements¶

Audit Stream Destinations — New Elasticsearch destination with index template management, cluster mode and CosmosDB support; new Syslog destination with TCP/UDP transport, CEF and Syslog format support; enhanced log stream service with destination-specific configuration validation
LDAP Authentication Improvements — Enhanced LDAP service with improved bind DN handling, group membership resolution, schema configuration flexibility, and better error diagnostics for connection failures
Notification Scheduler Redesign — Improved scheduling logic for certificate expiry notifications with batching support to reduce alert fatigue, JIRA integration for incident ticket creation, and email notification enhancements
Weekly Expiry Report Service — Redesigned report generation with recipient management, customizable report content, and improved delivery reliability
Project Template Enhancements — Extended template configuration with naming convention integration, advanced default settings, and improved template-to-project application workflow
Naming Convention Service — Extended naming convention engine with additional pattern support, validation rules, and convention-to-template linking for automated enforcement
Prometheus Metrics — New histogram and counter metrics for certificate rotation, compliance reporting, and audit stream performance monitoring
CI/CD Pipeline — New GitHub Actions workflow for automated build, test, and deployment
SSO Provider Modal — Added LDAP provider configuration with server, bind DN, and schema settings directly from the SSO configuration interface
WebLogic Deploy Rotation Step — New rotation step type for Oracle WebLogic Server keystore deployment with automated domain configuration updates

Security Updates¶

Entra ID credential rotation with full audit trail — every rotation recorded with actor, timestamp, old/new key IDs, and execution status
SmallStep CA operations logged to audit stream with complete request/response metadata
Certificate lifecycle phase prevents concurrent CA operations, eliminating race conditions in renewal and rotation workflows
Entra sync conflict detection with automatic tracking of local vs. remote state discrepancies

Version 1.0.19¶

Release Date: 2026-03-20

New Features¶

Azure Gateway Deployment — Multi-region Azure Gateway infrastructure with Terraform modules for AKS, Key Vault, PostgreSQL, Redis, networking, monitoring, and identity management; Helm chart values for gateway configuration; Azure DevOps CI/CD pipeline for automated deployment
Key Vault RBAC Service — Granular role-based access control for Azure Key Vault operations with per-secret and per-certificate permission management
Key Vault Watch Connector — Real-time synchronization between MazeVault and Azure Key Vault with change detection and automatic secret updates
Naming Convention Engine — Domain-specific naming rules with wildcard pattern matching, priority ordering, and template-level enforcement for consistent resource naming across projects
Dashboard Reports Tab — Redesigned reporting dashboard with certificate overview statistics, interactive charts, and exportable report data
Node.js SDK — Official MazeVault SDK for Node.js with TypeScript definitions, supporting authentication (SRP), organizations, projects, and secrets management

Improvements¶

Audit Log Project Scoping — Audit events now include project association for efficient per-project filtering and compliance reporting; existing events backfilled from entity relationships
Orchestrator Storage Mode Fix — Normalized inconsistent storage mode values for Orchestrator Mode deployments, resolving constraint violations
Entra Group Mappings — Improved group-to-role mapping reliability with better error handling and UI feedback
Config Encryption Hardening — Enhanced configuration encryption service with additional test coverage and improved error handling for edge cases
Certificate Import Validation — Improved certificate import service with stricter chain validation
Go SDK Updates — Updated project and model definitions for consistency with latest API
Python SDK Updates — Model alignment with latest API schema

Bug Fixes¶

Fixed environment creation for unused projects being triggered unnecessarily
Resolved Entra ID SSO login redirect issue on certain browser configurations
Fixed project template modal not preserving environment associations on save

Version 1.0.18¶

Release Date: 2026-03-14

Improvements¶

Customer Documentation Updated — Comprehensive ACME certificate automation guide with step-by-step Kubernetes setup, cert-manager ClusterIssuer examples, ACME profile routing, troubleshooting, and complete end-to-end YAML examples; updated Certificates API reference with ACME endpoints and EAB management; release notes reformatted to correct 1.0.x versioning scheme
Azure Entra ID Integration Improved — Enhanced token refresh handling, improved group-to-role mapping reliability, faster SSO login flow with reduced redirect latency, and better error messages for misconfigured tenant settings

Version 1.0.17¶

Release Date: 2026-03-14

New Features¶

ACME Server (RFC 8555) — MazeVault now acts as a full ACME Certificate Authority, enabling automated certificate issuance via cert-manager and other ACME clients
External Account Binding (EAB) — Secure cluster registration with one-time-use credentials linking ACME clients to organizations and projects
ACME Profile Routing — Map cert-manager profile names to MazeVault Certificate Templates for automatic CA backend selection (cert-manager v1.18+)
Domain Rule Engine — Configure domain-to-template routing rules with wildcard pattern matching and priority ordering
Auto-Approve for Internal Domains — Certificates for .local, .internal, .lan, and .corp domains are issued instantly without HTTP-01 challenge
ADCS Bridge via ACME — Issue certificates from Microsoft Active Directory Certificate Services through standard ACME protocol
ADCS Agent Improvements — DCOM retry logic for pending certificate requests with configurable intervals
EAB Credential Management UI — Generate, list, and revoke EAB credentials from the web interface with cert-manager YAML examples

Improvements¶

ACME directory endpoint with meta profiles for automated client discovery
JWS middleware with ES256 and RS256 signature verification
Nonce-based replay protection per RFC 8555 §6.5
Full PEM certificate chain delivery for ACME clients
EAB credentials table with status tracking (Available / Used / Revoked)
One-click copy for ACME directory URL and generated credentials

Security Updates¶

EAB HMAC keys encrypted at rest with AES-256-GCM
EAB credentials are single-use and support expiration and revocation
JWK Thumbprint verification (RFC 7638) for account binding
All ACME operations recorded in audit log

Version 1.0.16¶

Release Date: 2026-02-28

Improvements¶

Organization settings redesign with tabbed navigation
Certificate Authority account cards with sync status indicators
Improved CA product discovery and sync trigger via UI
Agent heartbeat interval optimization for large fleets
Database connection pool tuning for high-concurrency deployments

Bug Fixes¶

Fixed certificate chain validation for intermediate CA certificates
Resolved race condition in concurrent secret rotation scheduling
Fixed OCSP responder cache invalidation on certificate revocation

Version 1.0.15¶

Release Date: 2026-02-14

Improvements¶

PFX/PKCS#12 import with configurable key storage (software / HSM)
Certificate template override support for CA account-level defaults
Improved agent reconnection logic after network interruptions
Enhanced audit log filtering by event type and date range

Bug Fixes¶

Fixed certificate export with chain for cross-signed intermediates
Resolved project template settings not persisting after save
Fixed SSH key discovery deduplication for rotated keys

Version 1.0.14¶

Release Date: 2026-01-31

Improvements¶

SSH key management enhancements — authorized key tracking and discovery
Rotation trigger improvements with foreign key constraint handling
Secret sharing post-rotation with automatic re-encryption
Improved error messages for agent proxy authentication failures

Bug Fixes¶

Fixed rotation scheduler timezone handling for non-UTC installations
Resolved dashboard certificate count discrepancy after bulk import
Fixed API token expiration check for service identities

Version 1.0.13¶

Release Date: 2026-01-24

Improvements¶

React import modernization — tree-shaking optimized MUI imports
Frontend build size reduction (~15% smaller bundle)
Improved certificate search with wildcard SAN matching
Enhanced monitoring Prometheus metrics with histogram buckets

Bug Fixes¶

Fixed RBAC permission check for nested project environments
Resolved Terraform export formatting for complex secret values
Fixed health check endpoint returning stale Redis status

Version 1.0.12¶

Release Date: 2026-01-17

Improvements¶

Trivy container image scanning integration in CI/CD pipeline
Security vulnerability remediation for dependency chain
Improved TLS cipher suite configuration with Mozilla Intermediate profile
Enhanced rate limiting with sliding window algorithm

Bug Fixes¶

Fixed certificate renewal scheduling for certificates with custom validity
Resolved sync conflict for simultaneously edited secrets across datacenters
Fixed agent registration token validation for re-registered agents

Version 1.0.11¶

Release Date: 2026-01-10

Improvements¶

PostgreSQL connection health monitoring with automatic reconnection
Bidirectional sync architecture improvements for multi-region deployments
Agent installation script fixes for air-gapped environments
Onboarding flow improvements for remote deployment scenarios

Bug Fixes¶

Fixed database migration rollback for failed upgrades
Resolved LDAP group sync not reflecting membership changes
Fixed certificate list pagination for projects with > 1000 certificates

Version 1.0.10¶

Release Date: 2026-01-03

Improvements¶

Enhanced external change detection for CA-managed certificates
Improved Helm chart values documentation with inline comments
Certificate expiry notification batching to reduce alert fatigue
Updated Go dependencies with security patches

Bug Fixes¶

Fixed CRDT merge for concurrent secret version creation
Resolved Azure Key Vault sync retry logic for transient failures
Fixed OCSP responder returning incorrect status for renewed certificates

Version 1.0.9¶

Release Date: 2025-12-15

New Features¶

Certificate Template System — Pre-configured certificate profiles for common use cases (Web Server, Client Auth, Code Signing, Email/S-MIME)
Bulk Certificate Operations — Import and manage certificates in bulk via PEM bundles
Enhanced Agent Discovery — Automatic discovery of certificates across agent-managed infrastructure
Sync Improvements — CRDT-based multi-datacenter synchronization with improved conflict resolution
Terraform Export — Export project configurations as Terraform HCL for infrastructure-as-code workflows

Improvements¶

Improved certificate import validation and error reporting
Enhanced OCSP responder performance with response caching
Updated RBAC with granular certificate management permissions
Improved audit logging with structured JSON output
Enhanced health check endpoints with component-level status

Security Updates¶

TLS 1.3 as default protocol
Improved CSRF protection with double-submit cookie pattern
Enhanced rate limiting with per-endpoint configuration
Updated cryptographic dependencies

Version 1.0.8¶

Release Date: 2025-11-20

New Features¶

External CA Integration — Connect to DigiCert, Venafi, Microsoft ADCS, and other external Certificate Authorities
HSM Support — Hardware Security Module integration for key protection (PKCS#11, Azure Managed HSM)
ACME Protocol — Automated Certificate Management Environment for automated certificate issuance
Multi-Factor Authentication — TOTP-based MFA for enhanced account security

Improvements¶

Redesigned certificate management interface
Improved secret rotation scheduling
Enhanced API rate limiting
Expanded Azure Key Vault integration

Version 1.0.7¶

Release Date: 2025-09-10

New Features¶

Zero-Knowledge Encryption — Client-side encryption for personal vault secrets
SCEP Protocol Support — Simple Certificate Enrollment Protocol for device certificate management
EST Protocol Support — Enrollment over Secure Transport for modern certificate enrollment
Agent Proxy — Agents can proxy secret access for local applications

Improvements¶

Improved database migration system
Enhanced logging and monitoring
Updated Kubernetes deployment manifests
Performance improvements for large certificate stores

Version 1.0.6¶

Release Date: 2025-06-15

New Features¶

Multi-Datacenter Sync — Bidirectional synchronization between MazeVault installations
Azure Entra ID SSO — Single Sign-On with Azure Active Directory
Project-Level RBAC — Granular role-based access control per project
CRL Distribution — Automated Certificate Revocation List generation and distribution

Improvements¶

Improved dashboard with real-time status updates
Enhanced certificate search and filtering
Updated API documentation with OpenAPI 3.0 specifications
Improved container image security

Version 1.0.5¶

Release Date: 2025-03-20

New Features¶

OCSP Responder — Real-time Online Certificate Status Protocol responder
Secret Versioning — Full version history with rollback capabilities
Agent Management — Centralized agent registration and monitoring
LDAP Integration — Directory service authentication support

Version 1.0.4¶

Release Date: 2024-12-10

New Features¶

Internal Certificate Authority — Full PKI with root and intermediate CA support
Certificate Lifecycle Management — Request, approve, issue, renew, and revoke certificates
Helm Charts — Standardized Kubernetes deployment via Helm

Version 1.0.3¶

Release Date: 2024-09-15

New Features¶

Azure Key Vault Integration — Sync secrets with Azure Key Vault
Secret Rotation — Automated and manual secret rotation
Kubernetes Deployment — AKS deployment with Terraform

Version 1.0.2¶

Release Date: 2024-06-20

New Features¶

Role-Based Access Control — User roles and permissions
Project Management — Organize secrets into projects
API v1 — Full REST API for secrets management

Version 1.0.1¶

Release Date: 2024-03-01

Initial Release¶

Encrypted secrets storage with AES-256-GCM
Web-based management interface
PostgreSQL backend with Redis caching
Docker Compose deployment
Local authentication with SRP protocol

Support Policy

MazeVault supports the current version and one previous minor version. Customers on older versions are encouraged to upgrade to receive security updates and new features.