# CipherMail Gateway 6.5.2 released **URL:** \ **Category:** General\ **Created:** [November 4, 2026, 11:30am UTC](https://community.ciphermail.com/t/ciphermail-gateway-6-5-2-released/1070 "2026-11-04T11:30:45Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [November 4, 2026, 11:30am UTC](https://community.ciphermail.com/t/ciphermail-gateway-6-5-2-released/1070/1 "2026-11-04T11:30:45Z")
Today we are releasing CipherMail Email Encryption Gateway 6.5.2. This is a maintenance release with security hardening. It tightens how the gateway trusts certificates and accepts email addresses, adds Name Constraints to the local CA, and makes the virtual appliance images more robust during kernel updates. Some changes need a look before you upgrade (see below). ## Highlights **Security & hardening** - The Name Constraints extension of a **root** certificate is now enforced on every certificate of a chain built to it. Before this release only the constraints of intermediates were applied. - Only plain email addresses are accepted. An address with a display name, a comment or angle brackets, such as `bob@victim.com(x).corp.com`, was reduced to the address in front of it. That meant a certificate could be stored and selected for an address it does not contain. - The PDF Password Length setting is limited to 10 to 32 bytes. The default of 16 is unchanged. - A manually set client secret (`client-secret`) or OTP secret key (`pdf-otp-secret-key`) must now look like a generated one: base32 of at least 26 characters. A guessable key gave away the password of every OTP PDF of the user and let the user’s portal tokens be forged. You do not need to set either value. **Name Constraints for the local CA** - Create Local CA, the REST API and the CLI (`ca create root|intermediate --permitted-email-names ... --excluded-email-names ...`) can give a CA a Name Constraints extension on email names. Each name can be an address, a host or a domain (`.example.com`). - The certificate tables of the admin UI and the REST API certificate details show the Name Constraints of a certificate. **Virtual appliance and installation** - New virtual appliance images have a 2 GB `/boot` partition instead of 1 GB, and boot with both UEFI and BIOS. - The Hyper-V image is now a VHDX and runs as a Generation 2 virtual machine. Generation 1 still works. - `dracut-config-generic` is only installed on the virtual appliance images. A gateway installed on an existing AlmaLinux or RHEL machine no longer gets it, because its generic initramfs fills up `/boot`. - The Ansible variable `ciphermail_appliance__dnf_installonly_limit` sets how many kernels dnf keeps. The default is still 3. **Other changes** - The log viewer opens on the last hour (`1 hour ago` to `now`) instead of the last 10000 journal lines. Any `journalctl --since` expression can be entered. - Deleting a certificate now also deletes its private key, unless the certificate is still in the other store. Before, the key stayed behind and `certificate sync-keys-from-keystore` added the certificate back. A certificate that is in use, including the local CA certificate, cannot be deleted. - Dependencies are updated. **Bug fixes** - Oracle: searching certificates by subject or issuer failed with a `lower()` / CLOB error. - The Sign Header and Sign Subject Regex triggers now also force PGP signing. A message was not signed when PGP Skip Sign Only was enabled and the sender had no S/MIME signing certificate. - Routes of the admin UI, the portal and the company portal (such as `/success` after a login) are served with status 200 instead of a 404. A proxy in front of the gateway could replace that 404 with its own error page. ## Read this before upgrading - **Constrained roots are now enforced.** A chain that violates the root’s Name Constraints, or a root whose constraints cannot be decoded, is no longer trusted. If a constrained cross-certificate sits in the roots next to the unconstrained root, remove the cross-certificate. To restore the old behaviour, set the system property `ciphermail.certpath.check-root-name-constraints` to `false`. - **Addresses with a display name or comment are now invalid** wherever the gateway validates an address: certificate addresses, user names, recipients and settings. Exceptions: the System Email From setting may still carry a display name, and a PGP user ID in comment form (`bob@example.com (work key)`) is still reduced to the address. A stored certificate keeps its addresses until it is imported again. - **Deleting a certificate deletes its key, and a deleted key cannot be restored.** Export a certificate with its key before you delete it if you may need it again. `certificate orphaned-keys` lists the keys of certificates deleted before this release, and `keystore delete` removes one. If the key store refuses to delete a key, as some HSMs do, the certificate is kept. Set `ciphermail_backend__ignore_key_delete_failure` to `true` to delete the certificate and keep the key. - **`certificate sync-keys-from-keystore` no longer takes `--store`** and always syncs the certificates store. Scripts that pass `--store` must drop it. A sync of the roots store added every certificate with a private key to the roots and made each one a trust anchor. If you ever ran a roots sync, remove those certificates from the roots. - **PDF password length and OTP secrets:** values stored before this release keep working. An out-of-range PDF password length logs a warning on every use until you change it. You can change the lower bound with `ciphermail.pdf.min-password-length`. To return to the derived OTP key, clear `pdf-otp-secret-key`. - **CAs with Name Constraints:** the extension is critical, so a client that does not support Name Constraints rejects certificates issued by such a CA. - **Hyper-V Generation 2:** the virtual machine only starts with the Secure Boot template “Microsoft UEFI Certificate Authority” or with Secure Boot disabled. See the Hyper-V chapter of the virtual appliance guide. - **Existing appliances keep their 1 GB `/boot` partition** , their VM generation and their partitions. The Update chapter of the administration guide describes how to recover a kernel update that failed for lack of space in `/boot`, and how to keep fewer kernels. Full details are in the [release notes](https://www.ciphermail.com/gateway-release-notes.html).