Breadcrumbs

SignServer Cloud 4.2 Release Notes

OCTOBER 2026

We are pleased to announce the release of SignServer Cloud 4.2.

This release brings a significant amount of security and operational improvements as well as deeper password customization.

For available deployment options and associated versions, refer to Supported Versions.

Highlights

SignServer Enterprise Upgrade 7.9

SignServer Cloud updates SignServer Enterprise to version 7.9, see the SignServer Release Notes.

SignServer Cloud now runs on WildFly 41.0.1 and Java 21.

Configuration wizard

  • With the local database, the wizard asks for the database administrator (root) password. The password is saved in /root/.my.cnf (root only).

  • Default Management CA DN: the default Organization (O) is now a random node identifier instead of the instance ID.

Deployment files (automated installs)

  • New key: Local_DB_Password (local database).

  • Missing key: a random value is generated and saved to /root/.my.cnf, readable only by root.

Security improvements

  • New deployments no longer derive any default password from the cloud instance ID. Every credential is either set in the configuration wizard or generated randomly for the node.

  • The WildFly credential store password is random for each node and is no longer stored in standalone.xml. WildFly reads it at startup from /opt/keyfactor/wildfly_config/credstore.env, which only root can read.

  • The WildFly credential store and the files holding its secrets are kept together in /opt/keyfactor/wildfly_config/, which is owned by root. WildFly can read the credential store but cannot change anything in that directory.

  • The database master password saved by rotate_db_password.sh is kept in /opt/keyfactor/wildfly_config/database-master-password, readable only by root, instead of in the WildFly start script.

  • Installation, support and configuration files under /opt/keyfactor and /etc/wildfly are now owned by root.

  • The support scripts (system_backup.sh, system_restore.sh, new_tls_cert.sh) no longer run the WildFly start script or a temporary file as root. They read only the database settings from start.sh, as plain values.

  • Apache's TLS directory (/etc/httpd/ssl) is now owned by root, and its private keys are readable only by root.

  • Files containing credentials or private keys are now readable only by root and the service account that needs them. WildFly creates its own files without world-read access. The page that offers the SuperAdmin keystore for download after installation is readable only by the web server.

  • The installation log no longer contains passwords. Only root and the deploying administrator can read it.

  • Backups are no longer written unencrypted to the backup directory, and pre-restore database dumps are readable only by root.

  • new_tls_cert.sh uses a random one-time enrollment password. On AWS, it no longer makes a metadata request without an IMDSv2 token.

  • The unused wfmemset service has been removed.

  • The AJP connection between Apache and WildFly uses a random shared secret for each node.

  • Packer unpacks the layer as the unprivileged build user (tar xf without
    sudo). staging.sh then copied Static_Build into / with rsync -a as root,
    which kept that user's owner on every copied file and on every directory
    it passed through. Permissions fixed on file systems.

Operational changes

  • Backup and restore:

    • system_backup.sh and system_restore.sh connect to MariaDB/MySQL as the database administrator. On a local-database node, enter the admin password set in the wizard (also saved in /root/.my.cnf). If rotate_db_password.sh has saved the master password, they use it without asking.

    • Restoring a local-database backup no longer changes the database account passwords.

    • system_restore.sh stops without changing anything if it cannot back up the current database first.

    • system_restore.sh keeps the backup's start.sh as a reference copy, readable only by root, in /opt/keyfactor/wildfly_config/.

  • rotate_db_password.sh:

    • The credential store gets its own random password.

    • The master password is saved only after the database accepts the change.

    • -w no longer requires -m.