.png){kind=logo}
Released October 2025
New Features
DSS-3036 Add OIDC support in SignServer container
DSS-3230 Remove requirement for Crypto Workers to have a default key to be active
DSS-3234 Option to remove cmsAlgorithmProtect in ExtendedCMSSigner
DSS-3266 SignClient option for reading input from stdin \(working with rpmsign\)
DSS-3267 Support for RPM signing using SignWrapper-GPG
DSS-3279 Implement REST endpoints for listing workers/certificates supporting Signum MacOS Agent use case
DSS-3280 Add property to choose to use CRL or OCSP as priority in AdESSigner
Improvements
DSS-1814 PlainSigner should not require certificate
DSS-3025 Disable client certificate-based authorization in Admin web when OIDC is enabled \(by adding the oidc.properties file\)
DSS-3026 Error handling - oidc.properties file
DSS-3107 Add tests for OIDC implementation
DSS-3114 Remove EU repository cefdigital not needed anymore from pom.xml
DSS-3123 Issue with different provider rules
DSS-3124 Add visibility of authentication type in UI and style login/logout pages
DSS-3125 Add login/logout for client cert auth
DSS-3126 Add login/logout for OAuth
DSS-3147 Add validation of audience and configuration of it in oidc.properties
DSS-3160 Add support for Client side hashing for CAdES signer
DSS-3176 Add examples to OpenAPI and document the form-data fields
DSS-3202 Improve REST documentation
DSS-3224 Move hard coded callerGroupsClaim to oidc.properties
DSS-3226 Support Fortanix RSA with pre computed hash
DSS-3236 Allow caller to customize what's checked in healthcheck
DSS-3264 Change OpenPGPSigners to use RSA\_GENERAL instead of RSA\_SIGN or make it configurable
DSS-3265 Make OpenPGPSigner generated certificates with ECDSA work for RPM signing
DSS-3274 Change default signature algorithms in PlainSigner when client-side hashing is used
DSS-3294 Upgrade commons-lang3 to 3.18 or later due to CVE
DSS-3316 Change naming of managed key to be supported by AKV
DSS-3374 Upgrade commons-lang3 to 3.18 or later due to CVE
DSS-3392 OIDC callback servlet should not process callbacks when already logged in
DSS-3397 Improve list cert Ids test to not assume a specific order is returned
DSS-3400 Improve oidc.properties.sample
DSS-3402 Security hardening of legacy WS redirects
Bugs
DSS-3088 Documentation for enabling OpenAPI endpoint not working with WildFly 32/35 and EAP 8
DSS-3134 Incorrect "-" instead of "\_" in INTERNALLY-DETACHED/INTERNALLY\_DETACHED in template and docs
DSS-3146 cspPolicies cause to OIDC logout doesn't work properly in Chrome
DSS-3250 Admin web changes in the OIDC epic introduced new test failures
DSS-3255 Test keystore dss10\_signer1.p12 certificate expired Sun Jun 01 16:04:41 CEST 2025
DSS-3276 Authorization rule only imported for one worker when adding multiple using AdminCLI setproperties command
DSS-3345 Regression: Signing with PlainSigner always throws NullPointerException when NOCERTIFICATES=true and debug logging enabled
DSS-3361 PlainSigner set with NOCERTIFICATES=true with a Non existing DEFAULTKEY has Active status but throws an error when signing
DSS-3389 Regression: Status of worker is shown as OFFLINE if NOCERTIFICATES is used but key usage counter is not disabled and the key did not exist when the worker was loaded
DSS-3391 Regression: User name missing in top-right area in AdminWeb when client cert is used
DSS-3403 Regression: x509-common-util pom file breaks container build / pipeline that does not use JFrog repository
DSS-3410 Regression: Worker status reports error about missing key even when key has not been specified