Signotaur 2.0 Version History

v2.1.0.278

August 5th, 2026

Changes

New Enterprise Features

  • Document signing. 'SignotaurTool' can now produce ETSI Advanced Electronic Signatures as well as code signatures. XML files are signed as XAdES and PDFs as PAdES; other files can be signed as CAdES with '--format cades'. Choose the signature level with '--level': 'baseline', 'timestamped', 'long-term' or 'archival'. Long-term and archival signatures embed the certificate chain and revocation evidence, helping them to remain verifiable after the signing certificate expires. PDF signatures can have a visible appearance, and encrypted PDFs can be signed. The 'verify' command recognises all three formats.
  • Document-signing certificates. Document-signing certificates can now be registered alongside code-signing certificates, or issued from the Internal CA or Microsoft AD CS. Certificates issued by Signotaur carry the Microsoft, Adobe and RFC 9336 document-signing usages, so they are accepted by Adobe Acrobat and by other verifiers. Certificates registered before upgrading are recorded as code signing; re-register one to pick up a second purpose.
  • Validation Authority. The Internal CA can now publish revocation information for the certificates it issues, answering OCSP requests and publishing CRLs and CA certificates, optionally over a dedicated plain HTTP port. Certificates can be revoked from the managed certificates list, and are revoked automatically when deleted or replaced by a renewal. The CRL and CA certificates can also be published to an external destination over SFTP, FTP/FTPS, WebDAV or S3-compatible storage, so that revocation can be checked from outside your network. Only certificates issued after the Validation Authority is enabled carry its addresses; existing certificates cannot be updated.
  • Multiple Intermediate CAs. The Internal CA is no longer limited to a single intermediate. Several can now be added, each scoped to web (TLS), code signing, document signing or all purposes. Each can be reissued or paused independently. Existing installations keep their current intermediate as an all-purpose one.
  • Certificate identities and policies. Issued signing certificates can now carry a full structured subject following ETSI EN 319 412-2/-3, identifying either a natural person or an organisation, with email addresses as subject alternative names. Renewal preserves the whole subject rather than reducing it to the common name. Certificates can also state the ETSI EN 319 411-1 policy they were issued under (LCP, NCP or NCP+), with an optional link to your CP/CPS.

Improvements

  • The managed certificates list gains a Certificate authorities view, showing each Root with its Intermediate CAs nested beneath it, and now marks both the certificate currently served by the web interface and any revoked certificates. A whole certificate chain can be downloaded as a single PEM or '.p7b' file.
  • The Code Signing Certificates page is now Signing Certificates, and both it and My Certificates gain a Purpose column and filter where document signing is licensed. My Certificates now shows the same certificate details as the administration page.
  • Renewal now re-signs a certificate under the intermediate that originally issued it rather than the newest one, so a certificate no longer moves to a different CA.
  • Regenerating the Root CA no longer requires a restart unless the web certificate was issued by the Internal CA and must also be reissued.
  • Website Settings now warns that changing the server address will make the revocation addresses already stored in issued certificates unreachable.

Changes

  • The signing certificate's purpose is now enforced before signing begins. If the certificate is unsuitable for any artefact in a batch, the entire run fails without signing anything; previously, signing continued regardless. Certificates whose Key Usage permits neither digital signature nor non-repudiation are also refused. Pass '--warn-wrong-purpose' to warn and sign anyway. Verification reports these conditions as warnings, so existing signatures still verify.
  • An unsupported file type now stops a signing run before anything is signed, rather than after part of the batch has already been signed. Use '--continue-on-fail' to sign the rest of the batch, as before.
  • 'SignotaurTool' now returns dedicated exit codes for invalid or mutually exclusive arguments, unsuitable certificates, document-signing timestamp failures, invalid input formats and rate-limited requests. It also returns a new code when document signing is not licensed. Existing codes have not been renumbered, but some failures previously returned a different, generic or success code, so check any pipeline that depends on specific codes against the exit code reference.
  • The server now identifies the occupied port and returns a dedicated exit code when it cannot start because the website port is already in use.

Bug Fixes

  • Fixed automatic web-certificate renewal failing because the stored AD CS password was not decrypted.
  • Fixed certificate issuance failing with an unclear error when the requested validity extended beyond the issuing CA's expiry. The validity is now capped at the issuer's expiry.
  • Fixed an AD CS root or intermediate being shown in place of the Internal CA's own on servers using both.
  • Fixed overlapping column headers on the certificate tables.
  • Fixed renewed certificates not being marked as superseded on My Certificates.
  • Reworked several settings and certificate forms to react correctly to edits, fixing cases where the Save button could remain disabled.

Infrastructure

  • The server now requires .NET Runtime 10.0.10; the installer installs it if it is missing.
  • Various third-party package updates.

v2.0.0.198

June 25th, 2026

Changes

Bug Fixes

  • Encrypted backup restore. Passphrase-protected '.sigbak' archives created by the previous release omitted required cryptographic parameters and cannot be restored or verified. After upgrading, create a new backup, verify it with 'archive verify', and discard any backups from the previous release. Live server data and secrets were not affected.

Improvements

  • Safer backup restore. 'archive restore' now warns before overwriting the server configuration, database and certificates, and requires confirmation. Unattended restores must pass '--yes'. It also reports clearer errors for corrupt or truncated backups, databases still in use, access-denied paths and master key sealing failures.
  • Improved command-line output. 'archive' server command now displays clean, readable output instead of raw log lines. It also supports '--theme' ('General', 'Dark', 'Light' or 'None') and '--no-color'. Use '--theme Light' or the 'NO_COLOR' environment variable for white-background terminals.

v2.0.0.190

June 24th, 2026

Changes

New Enterprise Features

  • Enterprise licences are now available for Signotaur. Purchasing an Enterprise licence grants access to new features related to internally and externally managed certificates. Note that every server gets a one-time 90-day grace to set it up and evaluate it without an Enterprise licence: you get a single managed web (TLS) certificate, valid for up to 90 days, after which the server reverts to self-signed. Add an Enterprise licence to keep that web certificate auto-renewing and to issue and sign with managed code-signing certificates.
  • Internal Certificate Authority: Signotaur can now run its own built-in CA hierarchy (root + intermediate) to issue and manage code-signing and web (TLS) certificates directly. This includes on-demand issuance, automatic renewal and expiry notifications. A managed certificates list tracks current and superseded certificates.
  • External ADCS issuance. Managed certificates can also be issued from a Microsoft Active Directory Certificate Services server, over either the DCOM or Certificate Services (CertSrv) web transport, using enterprise certificate templates.

New Features

  • Web (TLS) certificate management. A dedicated admin area for the certificate presented by the server web interface, allowing selection of the source (self-signed, an existing PFX file, the Windows certificate store, or the managed CA), view the live certificate, its chain and expiry, and download the chain anchor (PEM or DER) with instructions for distributing it to client trust stores. Note that using the managed CA as the web-certificate source requires an Enterprise licence, but a one-time certificate can be issued with a capped 90-day validity.
  • Encrypted, portable backups. A new 'archive' command ('create', 'restore', 'verify', 'extract') produces passphrase-protected '.sigbak' backup bundles containing the configuration, database, and CA/managed certificates. Restoring a bundle on another machine re-seals secrets under that machine's key, providing a supported migration path. Scheduled backups now emit a full '.sigbak' archive when a backup passphrase is configured.
  • At-rest secret protection (DPAPI). On Windows, the master encryption key is sealed with a machine-bound DPAPI key, so an off-box copy of the configuration, CA private keys, and other at-rest secrets (VM snapshot, copied disk) cannot be decrypted without a proper restore. OAuth client secrets are now also encrypted at rest.
  • Per-API-key rate limiting. Optional fixed-window rate limiting can be enabled for gRPC signing endpoints, with configurable request counts and window durations per API key (off by default).

Improvements

  • Most server settings now take effect immediately, without a service restart — including email, event retention, password policy, session/login expiry, update-check preferences, the PKCS#11 PIN-failure limit, and enabling/disabling rate limiting. Settings that still require a restart (hostname and port, OAuth providers, log-file changes, and changes to an active rate limiter) now clearly indicate so with a restart-pending banner.
  • Configurable login session lifetimes. A login where "Remember me" is left unticked can now be given a shorter idle timeout, separate from the longer remembered-login lifetime, so unattended sessions expire sooner. Administrators can also choose whether sign-ins via external providers (Google, GitHub) stay signed in or last only for the browser session. Both are set under Settings → Options.
  • Concurrent-edit protection across all configuration screens: saving uses optimistic-concurrency tokens, and a conflict dialog shows when another administrator changed the same settings (and who/when) rather than silently overwriting them.
  • Editing settings now warns about unsaved changes before you navigate away, and a pre-save summary lists exactly what will change and when each change takes effect.
  • The installer offers five certificate-configuration modes (existing PFX, Windows certificate store, self-signed, built-in CA, and external AD CS) with dedicated sub-pages, and validates your selections — PFX/store certificates, self-signed generation, AD CS connectivity, and subject names — before letting you continue. The installer also honours the configured backup directory and takes a pre-upgrade backup.
  • The admin web app gained consistent save dialogs, buttons, dirty-change detection, and certificate-table layouts throughout.

Bug Fixes

  • Reworked several account and configuration forms to react correctly to edits — fixing cases where a submit button could remain disabled.

Infrastructure

  • Updated .NET SDK to v10.0.301.
  • Various third-party package updates.

Previous versions

View Signotaur Version 1.0 History.