AgileSec 3.4.1 Release Notes

FEBRUARY 2026

This AgileSec 3.4.1 release addresses several issues in the on-premises installer and includes targeted usability enhancements.

Bug Fixes

Removed permission check for keytool
Eliminated redundant permission 111 check when searching for keytool. Since keytool is extracted to a known location, the find operation is no longer needed.
Enhanced certificate subject component support
Added support for multiple Organizational Units (OU) and additional subject components including Locality (L) and other standard certificate fields.
Fixed CA private key validation during installation
Removed CA private key requirement check from installer. The private key is only needed for certificate generation, not installation. This resolves issues when users provide their own CA certificates without the private key.

Corrected use_single_client_cert comment
Fixed misleading comment that stated the expected value incorrectly.
Updated WebUI default configuration
Modified WebUI default configuration to disable the signup link on the login page.
Fixed service startup reliability with manage.sh
Resolved startup failures where sm service would not start reliably when using manage.sh start. Services now start consistently through manage.sh.
Corrected internal certificate DNS entries
Removed unnecessary DNS SANs when generating internal certificates. Updated installer to connect to OpenSearch using node_hostname.analytics_internal_domain instead of 127.0.0.1, ensuring the connection uses the correct hostname present in the certificate.

Configurable temporary directory for platform
Added support for specifying a custom temporary directory using the temp_directory setting. If left empty, it will default to <installation_directory>/temp.
Installer no longer uses /tmp
/tmp is no longer used by the installer. Instead <installer_directory>/temp is used.
Fixed subdomain support for access domains
Resolved installation failures when using subdomains like subdomain.domain.tld. Introduced separate variables for organization domain. Subdomains are now supported for access domains but remain unsupported for organization domain.
Removed root requirement for HAProxy during installation
HAProxy no longer needs to be run as root during the installation process, when configured on port < 1000. Only after the installation completes, HAProxy must be started as root and the API service must be restarted.
Configured temporary folder for Java services
Set explicit temp folder configuration for all Java services to ensure consistent temporary file handling.
Disabled performance statistics in production
Turned off performance stats collection for all Java services as it's unnecessary in production environments.
Enhanced installation summary
Updated the installation summary and installation guide to better highlight post-installation actions required by the user.

Release packages can be downloaded from the ISG download portal and include the following:

Access credentials are required for all download links.