X-Road v7.6.0 Release Notes

XRDDEV-2185

Improvement

Improve the information system TLS certificate table under subsystem internal servers in the Security Server to show the Subject Distinguished Name, Not Before and Not After fields from the certificate in the table. Additionally added support for sorting the table based on the fields.

XRDDEV-2536

Improvement

Introduce support for automatically renewing authentication and sign certificates issued by trusted CAs that support automated certificate management through ACME on the Security Server. Only certificates that have been originally issued using ACME can be automatically renewed. Automatic renewal is enabled by default and it can be disabled using the proxy-ui-api.acme-renewal-active system property.

The Security Server runs a certificate renewal job once an hour. The interval can be adjusted using the proxy-ui-api.acme-renewal-interval system parameter. The time when a certificate is ready for renewal is determined by the ACME server if the server supports the ACME ARI extension. Otherwise, the time is defined by the proxy-ui-api.acme-renewal-time-before-expiration-date system parameter which defaults to 14 days.

Please see the Security Server User Guide and the System Parameters User Guide for more detailed information about the feature.

XRDDEV-2542

Improvement

Introduce option to enable logging the Common Name (CN) field of the client certificate used by a consumer information system to communicate with the Security Server proxy module. When the option is enabled, the CN field is written to the proxy log (/var/log/xroad/proxy.log).

XRDDEV-2567

Improvement

Add support for collecting operational monitoring data on REST endpoint level. The endpoints are recorded as a combination of HTTP method and request path, for example, GET / /api/v1/books and POST/ /api/v1/books are recorded as different endpoints.

Before the change, collecting operational monitoring data from REST services was only possible from API level.

XRDDEV-2627

Fix

Bump all X-Road components to use JAVA 21.

XRDDEV-2652

Improvement

On the Central Server, add support for:

1. Listing Security Servers where a member is registered as a non-owner member.

2. Unregistering a non-owner member from a Security Server.

A list of Security Servers that are used by a member has been added to the Central Server's Member view.

XRDDEV-2656

Fix

Fix an issue that caused the Central Server incorrectly show the initialization wizard when the signer process was stopped even if the server had already been initialized.

XRDDEV-2659

Fix

Fix an issue that allowed deleting a disabled subsystem from the Security Server without needing to unregister the subsystem first.

XRDDEV-2665

Fix

Remove deprecated signer port 5558 from source code and documentation.

XRDDEV-2667

New

Introduce support for sending notification e-mails to member-specific contacts on Security Server when:

• authentication certificate automatic renewal over ACME succeeded / failed

• sign certificate automatic renewal over ACME succeeded / failed

• authentication certificate registration succeeded.

Success and failure notifications can be turned on and off separately with the proxy-ui-api.acme-renewal-success-notification-enabled and proxy-ui-api.acme-renewal-failure-notification-enabled system properties. By default, both notifications are enabled. Instead, the authentication certificate registration notification can be turned on and off with the proxy-ui-api.auth-cert-registered-notification-enabled system property. By default, the notification is enabled.

For the e-mail notifications to work, an external mail server needs to be configured in the /etc/xroad/conf.d/mail.yml file and the Security Server must be able to communicate with it. The configuration can be tested using the Security Server’s Diagnostics view that provides a feature for sending test e-mails.

XRDDEV-2682

Fix

Fix an issue with the Security Server Sidecar that caused automatic backups to fail on Kubernetes without a manual configuration change by an administrator.

XRDDEV-2683

Fix

Fix an issue with the Security Server Sidecar that caused conflicting configuration values to be applied from country-specific meta packages. For example, in the Estonian flavor (-ee) of the Sidecar access to the client proxy was allowed only from inside the container itself by default.

XRDDEV-2686

Improvement

Add support for including the proxy-ui-api module's access log in the STDOUT of the Security Server Sidecar.

XRDDEV-2687

Improvement

Add support for verifying and logging messages with non-batch signatures. X-Road 8 will support non-batch signatures and being able to verify and log them is required in X-Road 7 to be interoperable with X-Road 8.

XRDDEV-2692

Fix

Fix an issue with the Security Server Keys and Certificates view that caused visual duplications in the table element under certain circumstances.

XRDDEV-2693

Improvement

Improve Security Server and Central Server codebase to allow for different types of keys to be used instead of hardcoded RSA support.

XRDDEV-2694

Improvement

Add support for using Elliptic Curve Cryptography (ECC) in authentication and sign keys on the Security Server. In addition, RSA keys continue to be supported too.

XRDDEV-2695

Improvement

Add support for using Elliptic Curve Cryptography (ECC) in signing and verifying the global configuration. In addition, RSA keys continue to be supported too.

XRDDEV-2697

Fix

Fix issues in the Security Server UI that caused unnecessary warnings in the browser console.

XRDDEV-2714

Improvement

Add support for including the output of the global configuration verification process in the STDOUT of the Security Server Sidecar.

XRDDEV-2718

Fix

Fix the following issues with the advanced database connection configuration options:

• Database connection authentication keys stored under /etc/xroad/ssl/ had their file permissions incorrectly changed during the backup restoration process.

• Backup restoration script connects only to the first node even if multiple nodes are defined in the connection string.

• PGHOST parameter ignored during restore process.

XRDDEV-2723

Fix

Update the PKCS11 library to the latest version.

XRDDEV-2728

New

Add support for multiple languages in the Central Server and Security Server UIs. The user is able to select any of the available languages using the language menu available in the Central Server and Security Server UIs. However, this task doesn’t add support for any additional languages besides English.

XRDDEV-2729

Fix

Fix an issue that prevented deleting a subsystem that is both a consumer and producer on the same Security Server. Deleting the subsystem failed due to a database constraint.

XRDDEV-2731

Fix

Improve variable handling on the Security Server UI to preempt Client-Side Path Traversal (CSPT) attacks.

XRDDEV-2732

Fix

Disable listening to ACME HTTP challenges on port 4000 on the Security Server.

XRDDEV-2733

Fix

Harden request path validation on the Security Server for ACME HTTP challenges to preempt potential weaknesses in future implementation changes.

XRDDEV-2759

Fix

Fix an issue on the Security Server that caused the proxy-ui-api service not being started automatically after a fresh metapackage install.

XRDDEV-2765

Fix

Rename two Configuration Client’s ([configuration-client]) system parameters to match the system parameter naming convention:

• global_conf_tls_cert_verification -> global-conf-tls-cert-verification

• global_conf_hostname_verification -> global-conf-hostname-verification

If the default values have been overridden in the /etc/xroad/conf.d/local.ini configuration file, they are migrated to the new format automatically during version upgrade.

XRDDEV-2787

New

Add support for the Spanish language in the Central Server and Security Server UIs.

XRDDEV-2788

New

Add support for the Estonian language in the Security Server UI.

Jammy

deb https://artifactory.niis.org/xroad-release-deb jammy-7.5.0 main

Noble

deb https://artifactory.niis.org/xroad-release-deb noble-7.5.0 main

RPM / RHEL8

https://artifactory.niis.org/xroad-release-rpm/rhel/8/7.5.0/

RPM / RHEL9

https://artifactory.niis.org/xroad-release-rpm/rhel/9/7.5.0/

Docker

https://hub.docker.com/r/niis/xroad-security-server-sidecar

https://artifactory.niis.org/api/gpg/key/public

935CC5E7FA5397B171749F80D6E3973B

A01B FE41 B9D8 EAF4 872F A3F1 FB0D 532C 10F6 EC5B

Ubuntu key server