CipherMail Gateway 6.5.2 released

General
1

Today we are releasing CipherMail Email Encryption Gateway 6.5.2.

This is a maintenance release with security hardening. It tightens how the gateway trusts certificates and
accepts email addresses, adds Name Constraints to the local CA, and makes the virtual appliance images more
robust during kernel updates. Some changes need a look before you upgrade (see below).

Highlights

Security & hardening

  • The Name Constraints extension of a root certificate is now enforced on every certificate of a chain built
    to it. Before this release only the constraints of intermediates were applied.
  • Only plain email addresses are accepted. An address with a display name, a comment or angle brackets, such as
    bob@victim.com(x).corp.com, was reduced to the address in front of it. That meant a certificate could be
    stored and selected for an address it does not contain.
  • The PDF Password Length setting is limited to 10 to 32 bytes. The default of 16 is unchanged.
  • A manually set client secret (client-secret) or OTP secret key (pdf-otp-secret-key) must now look like a
    generated one: base32 of at least 26 characters. A guessable key gave away the password of every OTP PDF of
    the user and let the user’s portal tokens be forged. You do not need to set either value.

Name Constraints for the local CA

  • Create Local CA, the REST API and the CLI
    (ca create root|intermediate --permitted-email-names ... --excluded-email-names ...) can give a CA a Name
    Constraints extension on email names. Each name can be an address, a host or a domain (.example.com).
  • The certificate tables of the admin UI and the REST API certificate details show the Name Constraints of a
    certificate.

Virtual appliance and installation

  • New virtual appliance images have a 2 GB /boot partition instead of 1 GB, and boot with both UEFI and BIOS.
  • The Hyper-V image is now a VHDX and runs as a Generation 2 virtual machine. Generation 1 still works.
  • dracut-config-generic is only installed on the virtual appliance images. A gateway installed on an existing
    AlmaLinux or RHEL machine no longer gets it, because its generic initramfs fills up /boot.
  • The Ansible variable ciphermail_appliance__dnf_installonly_limit sets how many kernels dnf keeps. The default
    is still 3.

Other changes

  • The log viewer opens on the last hour (1 hour ago to now) instead of the last 10000 journal lines. Any
    journalctl --since expression can be entered.
  • Deleting a certificate now also deletes its private key, unless the certificate is still in the other store.
    Before, the key stayed behind and certificate sync-keys-from-keystore added the certificate back. A
    certificate that is in use, including the local CA certificate, cannot be deleted.
  • Dependencies are updated.

Bug fixes

  • Oracle: searching certificates by subject or issuer failed with a lower() / CLOB error.
  • The Sign Header and Sign Subject Regex triggers now also force PGP signing. A message was not signed when PGP
    Skip Sign Only was enabled and the sender had no S/MIME signing certificate.
  • Routes of the admin UI, the portal and the company portal (such as /success after a login) are served with
    status 200 instead of a 404. A proxy in front of the gateway could replace that 404 with its own error page.

Read this before upgrading

  • Constrained roots are now enforced. A chain that violates the root’s Name Constraints, or a root whose
    constraints cannot be decoded, is no longer trusted. If a constrained cross-certificate sits in the roots next
    to the unconstrained root, remove the cross-certificate. To restore the old behaviour, set the system property
    ciphermail.certpath.check-root-name-constraints to false.
  • Addresses with a display name or comment are now invalid wherever the gateway validates an address:
    certificate addresses, user names, recipients and settings. Exceptions: the System Email From setting may still
    carry a display name, and a PGP user ID in comment form (bob@example.com (work key)) is still reduced to the
    address. A stored certificate keeps its addresses until it is imported again.
  • Deleting a certificate deletes its key, and a deleted key cannot be restored. Export a certificate with its
    key before you delete it if you may need it again. certificate orphaned-keys lists the keys of certificates
    deleted before this release, and keystore delete removes one. If the key store refuses to delete a key, as
    some HSMs do, the certificate is kept. Set ciphermail_backend__ignore_key_delete_failure to true to delete
    the certificate and keep the key.
  • certificate sync-keys-from-keystore no longer takes --store and always syncs the certificates store.
    Scripts that pass --store must drop it. A sync of the roots store added every certificate with a private key
    to the roots and made each one a trust anchor. If you ever ran a roots sync, remove those certificates from the
    roots.
  • PDF password length and OTP secrets: values stored before this release keep working. An out-of-range PDF
    password length logs a warning on every use until you change it. You can change the lower bound with
    ciphermail.pdf.min-password-length. To return to the derived OTP key, clear pdf-otp-secret-key.
  • CAs with Name Constraints: the extension is critical, so a client that does not support Name Constraints
    rejects certificates issued by such a CA.
  • Hyper-V Generation 2: the virtual machine only starts with the Secure Boot template “Microsoft UEFI
    Certificate Authority” or with Secure Boot disabled. See the Hyper-V chapter of the virtual appliance guide.
  • Existing appliances keep their 1 GB /boot partition, their VM generation and their partitions. The Update
    chapter of the administration guide describes how to recover a kernel update that failed for lack of space in
    /boot, and how to keep fewer kernels.

Full details are in the release notes.