Release Notes
Highlighted features and updates related to Red Hat Certificate System 11
Abstract
Chapter 1. Red Hat Certificate System 11
This section contains general information about Red Hat Certificate System 11, such as the supported platforms and system requirements, installation notes, and deprecations.
1.1. Prerequisites
Installing Red Hat Certificate System 11 requires Red Hat Enterprise Linux 10. For details on how to install Red Hat Enterprise Linux 10, see Interactively installing RHEL from installation media.
1.2. Hardware Requirements
This section describes the minimal and recommended hardware for Red Hat Certificate System 11. Note that, depending on your environment, more resources might be required.
1.2.1. Minimal Requirements
- CPU: 2 threads
- RAM: 2 GB
- Disk space: 20 GB
The minimal requirements are based on the Red Hat Enterprise Linux 10 minimal requirements. For details, see Red Hat Enterprise Linux technology capabilities and limits.
1.2.2. Recommended Requirements
- CPU: 4 or more threads, AES-NI support
- RAM: 4 GB or more
- Disk space: 80 GB or more
1.3. Supported platforms
This section describes the different server platforms, hardware, tokens, and software supported by Red Hat Certificate System 11.
1.3.1. Server Support
Running the Certificate Authority (CA), Key Recovery Authority (KRA), Online Certificate Status Protocol (OCSP), Token Key Service (TKS), Token Processing System (TPS), Automated Certificate Management Environment (ACME), and Enrollment over Secure Transport (EST) subsystems of Red Hat Certificate System 11 is supported on Red Hat Enterprise Linux 10. Each Red Hat Certificate System 11 minor release is tested and released on a specific Red Hat Enterprise Linux 10 minor version. Additionally, each minor version of Red Hat Certificate System is also tested against a specific version of Red Hat Directory Server. The following table shows the minor versions tested and supported with Red Hat Certificate System.
Table 1.1. Versions of Red Hat Enterprise Linux and Red Hat Directory Server supported and tested with Red Hat Certificate System 11.x versions
| Red Hat Certificate System version | Red Hat Enterprise Linux version | Red Hat Directory Server version |
|---|---|---|
| 11.0 | 10.2 | 13.1 |
Red Hat Certificate System 11 is supported running on a Red Hat Enterprise Linux 10 virtual guest on a certified hypervisor. For details, see the Which hypervisors are certified to run RHEL? solution article.
1.3.2. Client Support
The Enterprise Security Client (ESC) is supported on:
Red Hat Enterprise Linux 8 and 9.
Although these platforms do not support Red Hat Certificate System 11, those clients can be used with the Token Management System (TMS) system in Red Hat Certificate System 11.
1.3.3. Supported Web Browsers
Red Hat Certificate System 11 supports the following browsers:
Table 1.2. Supported Web Browsers by Platform
The only fully-supported browser for the HTML-based instance configuration is Mozilla Firefox.
1.3.4. Supported Smart Cards
The Enterprise Security Client (ESC) supports Global Platform 2.0.1 compliant smart cards and JavaCard 2.1 or higher.
The Certificate System token management subsystems have been tested using the following tokens:
- Giesecke & Devrient (G&D) SmartCafe Expert 7.0 (SCP03)
- Thales SC230-Dev (SCP03)
The only card manager applet supported with Certificate System is the CoolKey applet, which is part of the redhat-pki-tps package in Red Hat Certificate System.
1.3.5. Supported Hardware Security Modules
The following table lists Hardware Security Modules (HSM) supported by Red Hat Certificate System.
| HSM | Firmware | Client Software |
|---|---|---|
| nCipher nShield Connect XC (High) | 12.72.1 | 12.71.0 |
| Thales TCT Luna T-Series HSM product family | 7.15.5 | 7.15.1-2 |
Currently, only the Thales TCT Luna T-Series HSM product family has been validated for use with ML-DSA. This table will be updated as additional HSMs are validated. Testing for ML-KEM key archival and recovery with selected HSMs is currently being pursued.
1.4. Quickstart for installing RHCS subsystems
The following procedure describes the prerequisites and the basic installation process for Red Hat Certificate System 11.
Prerequisites
- The latest Red Hat Enterprise Linux 10 version is installed with an active network connection. For the latest iso image, see This content is not included.Download Red Hat Enterprise Linux.
Procedure
Register the system to a Customer Portal account using Red Hat Subscription Manager (RHSM), then list the subscriptions available on this account for the system you registered:
$ subscription-manager register $ subscription-manager list --available --all
Attach the required subscriptions for Red Hat Enterprise Linux Server and Red Hat Certificate System using the corresponding pool IDs obtained in the previous step:
$ subscription-manager attach --pool=POOL_ID_RHEL_SERVER $ subscription-manager attach --pool=POOL_ID_CERT_SYSTEM
Make sure Red Hat Enterprise Linux has the latest updates:
$ dnf updateInstall the Directory Server module:
$ dnf install redhat-ds-
Ensure that a real domain name is specified is
/etc/resolv.confa host name is set within/etc/hosts. Run the Directory Server interactive installer and customize as required.
$ dscreate interactiveFor more information or for other installation methods, refer to the Red Hat Directory Server installation guide.
Install Certificate System packages and dependencies:
$ dnf install redhat-pkiRun the
pkispawnscript to create and configure the subsystem instances. You must install and fully configure at least one CA subsystem before you can configure any other type of subsystem. For details, see thepkispawnmanpage. Without options, pkispawn runs in interactive mode, prompting the user for basic information required for installation.$ pkispawn- Access the agent interface of various Red Hat Certificate System subsystems by using a properly configured local or remote Mozilla Firefox web browser.
Installing and configuring Red Hat Certificate System subsystems is described in more detail in the Planning, Installation, and Deployment Guide.
1.5. Deprecated and removed functionality
This section describes deprecated and removed functionality in Red Hat Certificate System 11.
pkiconsole has been removed in RHCS 11
Red Hat Certificate System (RHCS) 11 no longer provides the pkiconsole utility. The functionality has been replaced by the command-line interface (CLI) and the Web user interface (UI).
As a result, you must use the CLI or the Web UI to manage Certificate System operations previously handled by pkiconsole.
Chapter 2. Red Hat Certificate System 11.0 on Red Hat Enterprise Linux 10.2
This section describes significant changes in Red Hat Certificate System 11.0 on RHEL 10.2, such as highlighted updates and new features, important bug fixes, and current known issues users should be aware of.
2.1. Updates and new features in CS 11.0
This section documents new features and important updates in Red Hat Certificate System 11.0:
New tools added for HSM compatibility verification
This update introduces two simulation tools to verify basic Hardware Security Module (HSM) compatibility with the Dogtag Certificate System without requiring a full installation:
-
hsmCompatVerifyServ- A server-side simulator for Certificate Authority (CA) and Key Recovery Authority (KRA) operations. -
hsmCompatVerifyClnt- A client-side simulator for certificate enrollment.
Both tools support RSA and ECC key operations, key archival and recovery workflows, and PKCS#12 export. As a result, you can validate HSM integration and functionality before deploying a complete Certificate System environment.
The Certificate System now supports ML-DSA keys and signatures
With this enhancement, the Certificate System supports the Module-Lattice-based Digital Signature Algorithm (ML-DSA) for both keys and signatures. Because ML-DSA is standardized by NIST to withstand potential quantum computing threats, the Certificate System can now generate and manage quantum-resistant certificates.
This release supports ML-DSA at three NIST-defined security levels: ML-DSA-44, ML-DSA-65, and ML-DSA-87.
2.2. Technology Previews
There are no technology previews in this release.
2.3. Bug fixes in CS 11.0
This part describes bugs fixed in Red Hat Certificate System 11.0 that have a significant impact on users.
Two-step KRA installation with an HSM no longer fails during certificate validation
Before this update, a two-step Key Recovery Authority (KRA) installation using a Hardware Security Module (HSM) failed due to a certificate validation error.
With this release, the validation logic has been updated to verify the certificates correctly during the deployment process.
As a result, the two-step KRA installation with an HSM now completes successfully.
OCSP responder now returns standard error codes for internal errors
Before this update, if the Online Certificate Status Protocol (OCSP) responder encountered an internal error, such as missing Certificate Revocation List (CRL) data, it threw an exception. OCSP clients then interpreted this exception as an invalid response.
With this release, the OCSP responder has been updated to return a proper internal error code as defined in RFC 6960.
As a result, clients can now correctly identify when an internal error occurs on the responder side instead of treating the response as invalid.
pkispawn no longer fails due to invalid Tomcat paths in systemd service files
Before this update, systemd service files referenced incorrect paths for the Tomcat executable and startup scripts, pointing to /usr/bin instead of /usr/sbin. Additionally, an invalid inline comment was present in the service configuration. As a consequence, the pkispawn utility failed during deployment.
With this release, the executable and script paths have been corrected to /usr/sbin, and the invalid comment has been removed from the service files.
As a result, pkispawn now successfully starts the Tomcat service and completes the installation without encountering path-related errors.
2.4. Known issues in CS 11.0
This part describes known problems users should be aware of in Red Hat Certificate System 11.0, and, if applicable, workarounds.
KRATool now supports cross-scheme migration for archived keys
KRATool command now supports a preliminary implementation of cross-scheme migration, allowing migration of archived keys between different key wrapping schemes, for example DES3 to AES, or RSA to RSA-OAEP. This preliminary implementation currently contain a few unresolved issues:
- When the source and target payload wrap algorithm names are identical but the key sizes differ (e.g., AES-128 to AES-256 using "AES KeyWrap/Padding" for both), KRATool generates a session key with the source key size instead of the target key size.
- Cross-scheme migration from DES3 source keys fails because the session key unwrap is hardcoded to use AES. DES3 source keys require DES3 key type with 168-bit strength for the unwrap operation.
- When migrating to an HSM target (e.g., Luna), the target payload wrap algorithm must be set to "AES KeyWrap/Wrapped" instead of the default "AES KeyWrap/Padding". The default maps to an NSS-proprietary PKCS#11 mechanism that HSMs cannot process.