Version 6.3.5 of the CipherMail gateway was released on 14 September 2026. The focus of this release is performance and memory usage, especially for installations that work with large CRLs. It also contains a security fix and a few changes that are worth reading before you upgrade.
Performance and memory
Decoded CRLs are now kept in memory, so a CRL is parsed and its signature verified once instead of once per certificate checked against it. On a 46.7 MB CRL with a million revoked certificates, a single check previously cost about 1.5 seconds and allocated 1.7 GB, and concurrent checks could exhaust the back-end heap. The cache size is derived from the heap by default (one eighth of it) and can be set explicitly.
The revocation status of a certificate chain is now cached as well. Entries do not expire on a timer; they are dropped whenever the CRL store changes, so a cached result never outlives the CRLs it was based on.
Messages larger than 1 MB are now held in a temporary file and processed as a stream instead of being kept on the heap. This covers the mail queue, S/MIME and PGP encryption, decryption and signing, PDF encryption, DKIM signing, and the IMAP client and webmail downloads. Note that the default number of spool threads has been lowered to 5 as a result; the new “Memory and Performance” chapter of the administration guide explains how to size this for your machine.
For clusters, the scheduled CRL download is now done by one node where possible rather than by every node, and two new commands (ciphermail-cli crl cache-statistics and crl invalidate-caches) let you inspect or drop what a node has derived from the CRL store.
Other changes worth noting
The number of S/MIME and PGP parts handled per incoming message is now bounded, as is what importing certificates and keys from email can add. Sizes throughout the portal and webmail are now reported in decimal units, so displayed numbers change without anything actually being resized. There is also a new company portal on port 8444 (disabled by default) from which authenticated company users can send SMS messages, and support for resolving the real client IP when the gateway runs behind a proxy.
The full release notes are at Email Encryption Gateway release notes - CipherMail Email Encryption