Release Notes

What each DuoKey Cockpit v2 release brings, from the first production release to the latest.

Applies to:

Cockpit v2

This page summarises each production release of the DuoKey Cockpit at a high level. The newest release comes first. Changes that alter existing behaviour are listed under Behaviour changes in each release.

Version	Released	Focus
2.0.9	11 October 2026	DKE labels follow key rotation, SMTP relay CA in the settings forms
2.0.8	9 October 2026	Stable DKE label URL and key history, Secure Folders and S/MIME extensions, OpenPGP import
2.0.7	6 October 2026	AND/OR access policies, vault health monitoring, on-prem private targets
2.0.5 / 2.0.6	6 October 2026	Secure Folders, DKE Mail Quarantine, managed S/MIME, Merkle Tree CA, FileVault
2.0.4	24 September 2026	OpenTelemetry tracing, broader CPM discovery
2.0.3	10 September 2026	On-prem connection diagnostics
2.0.2	9 September 2026	Saudi compliance frameworks, VictoriaLogs SIEM target, F5 scan source
2.0.1	19 August 2026	Web front-end configuration fix
1.0.1 / 2.0.0	17 August 2026	CAP M365 Connector, more certificate deploy targets, audit hardening
1.0.0	9 August 2026	First production release

Version numbers

2.0.0 is the same build as 1.0.1, and 2.0.6 the same build as 2.0.5. They only moved the version number.

2.0.9

Released: 11 October 2026

• DKE: labels that name a key follow a rotation. A sensitivity label whose URL still names a key (/dke/{key_id}, the form every label used up to 2.0.7) now encrypts new documents with the service's current key after a rotation, with no change to the label in Purview. The rotated-out key stays decrypt-only for the documents that use it.
• DKE: key rename. Renaming a key no longer leaves the old name on the DKE service, for the current key or for rotated-out keys. URLs never carried the key name, so nothing broke.
• SMTP: relay CA certificate in the forms. When TLS is on, Host Settings → Email / SMTP and Notifications → SMTP Settings take a CA certificate (PEM) for a relay whose certificate comes from a private PKI. It applies to that relay only, without a restart.
• Settings. The tenant Email / SMTP tab now shows the real form. The General, LDAP and Invoice tabs are removed: they saved nothing. Billing details stay under Subscription → Billing profile.

Behaviour changes

• After a rotation, a label that still holds /dke/{key_id} encrypts with the new key. A retired key, or a key the service never served, still answers 404.

2.0.8

Released: 9 October 2026

• DKE: stable label URL. The label URL is now /dke/{slug}. It names the service, not a key, so a key rotation no longer requires a new label.
• DKE: per-service key history. A rotated-out key stays decrypt-only until an administrator retires it. A retired key can be restored. The service page shows the label URL and the key history.
• Secure Folders. Persistent encryption, folder officers and dual control, external sharing and key export. Programs can be trusted for what they are, and launch brokering and UI isolation become folder policies. An access journal records file access. Sealing uses hybrid post-quantum cryptography. The Windows agent is also packaged for Configuration Manager (SCCM / MECM).
• S/MIME. External correspondents and a public-key deposit portal. The key escrow is sealed with a key from the tenant's vault.
• OpenPGP. Import private keys and keyrings to migrate an existing OpenPGP estate.
• Merkle Tree CA. Aligned with draft 07 of the IETF specification (per-CA IANA identifiers).
• SIEM. Named activity events and the Secure Folders access journal are forwarded. Splunk and Elastic targets accept a private CA, and a connection failure states its cause.
• SMTP. NTLM authentication for relays that offer nothing else (for example an Exchange receive connector with Basic authentication off). Clearer authentication errors. Write the user name as DOMAIN\user.
• DuoKey CPM. The URL-list campaign script produces an interactive report (filters, country map, application-by-country matrix), skips unreachable targets after 5 seconds, and keeps going when an agent call times out.
• Agents. Every shipped agent binary carries its release version.

2.0.7

Released: 6 October 2026

• Access policies: AND or OR across rule tabs. Each policy now chooses how its rule tabs (User, Device/IP, Location, Time, Groups) combine: All tabs must match (AND) or One tab is enough (OR). See Access Policies.
• Vault health monitoring. Every 5 minutes the Cockpit checks each active remote vault and logs one vault_unreachable error line per unreachable vault, ready for a SIEM alert, and a vault_recovered line when it answers again. The vault page's liveness panel now shows these stored checks (uptime, latency, downtime windows) instead of simulated figures. See Vaults.
• On-prem: private targets. One deployment-wide allow-list lets connectors (secret stores, identity providers, webhooks, ticketing, certificate issuers, SMTP) reach systems on the customer's private network. See Cockpit Configuration.
• On-prem: binaries from a local directory. Without an object store, the Cockpit serves the scanner agent, the HSM agent, the SQL Server EKM provider DLL and the PKCS#11 library from a local directory.
• Audit. The audit log records the backend error message (for example why a DKE decrypt was refused), with secrets redacted and the text capped at 1000 characters.
• Terraform provider. Signed releases with customer-side verification. It can bootstrap a SaaS platform protected by two-factor authentication.
• DuoKey CPM. A campaign script scans a long URL list with the agent. Findings state whether a protocol has a post-quantum standard yet, which TLS libraries negotiate the hybrid group by default, and the protocol and code scope of source findings.
• Branding. Custom CSS is limited to theme tokens.

Behaviour changes

• New access policies use AND unless OR is chosen, including through the API when the setting is omitted. Existing policies stay on OR until an administrator switches them.
• Deployments that never set the audit detail level now record error messages in audit rows (level Standard). Choose Minimal under Settings → Audit to opt out.
• The Cockpit now calls each active remote vault (cloud KMS included) every 5 minutes for the health check. The job can be paused under Administration → Scheduled jobs.

2.0.5 / 2.0.6

Released: 6 October 2026

• Secure Folders (new). Encrypted folders managed from the Cockpit, with a Windows agent, a macOS client and an Intune package for the Windows agent.
• DKE Mail Quarantine (new). Protects mail already stored in Exchange Online mailboxes with a DuoKey DKE sensitivity label: messages older than a chosen age are rewritten as protected mail, attachments included, and the plaintext original is moved to a hidden quarantine folder. A customer-side agent does the work, driven from the Cockpit.
• Managed S/MIME (new). Per-user certificates, key escrow and key recovery, delivery through Intune.
• Merkle Tree CA (new). Merkle Tree Certificates (IETF draft) with an issuance log, checkpoints and landmarks.
• Disk encryption. FileVault with recovery-key escrow.
• DuoKey CPM. Crypto assets are de-duplicated across scans, and an asset replaced at the same location by a newer scan is resolved. A scanner agent can upload its result as a regular scan. Source scans find algorithms named through JOSE and XML-DSig identifiers, and report where code handles certificates or turns TLS on for another system.
• Vanta. Quantum Readiness custom framework and custom resources.
• Sign-in. Unlocking an idle SSO session works with TOTP or Windows Hello.
• Fixes. The access policy of a DKE service can be removed, and an invalid one is refused cleanly. The key edit page is restored. Health checks are bounded when the cache is down. Administrator-authored email HTML is sanitised. On-prem deployments can allow-list private SMTP relays.

Behaviour changes

• Expect more quantum-vulnerable findings on the next source scan: JWT and SAML libraries that select RSA or ECDSA are now counted. Findings in test and example code drop to Info.

2.0.4

Released: 24 September 2026

• Observability. OpenTelemetry tracing over OTLP/HTTP and JSON logs, with spans on vaults, secret managers, services, sign-in and background jobs, propagated across services.
• DuoKey CPM. STARTTLS and any TLS port can be scanned from the CLI, the REST API and MCP. New: an agentless fleet census, a deterministic CBOM, service fingerprinting on discovery, passive analysis of 11 cleartext protocols, a Windows NTLM policy audit, nmap XML import and a scan diff. More languages (Ruby, PHP, Swift, Kotlin, Zig) and dependency ecosystems (including Go and Conan), nginx and Apache TLS configuration assessment, NIS2 and DORA mappings, and detection of ML-DSA-44 DNSSEC zone signing.
• Secrets. The remaining stored credentials move to the configured secret backend.
• Splunk. The DuoKey Cockpit Security app downloads from a configured integration.
• Fixes. The Sepior adapter uses AES-GCM. The Software Vault key store is scoped per tenant. Vault-sync key import works. The Quantum Risk Score breakdown adds up to the printed score. Responses carry the request ID.

2.0.3

Released: 10 September 2026

• Diagnostics. Connection errors to on-prem back-ends keep their full cause, so failures can be diagnosed.

2.0.2

Released: 9 September 2026

• Compliance. Reports are in English with a tenant-branded HTML export. New Saudi frameworks: NCA ECC-2, SAMA CSF and PDPL / NDMO. A compliance report can be deleted.
• DuoKey CPM. F5 BIG-IP as a scan source. A per-tenant cap on concurrent scans, set by edition.
• SIEM. VictoriaLogs as a syslog target, and syslog over TLS.
• Splunk. The DuoKey Cockpit Security app is versioned and packaged.
• Fixes. Provisioning-only identity providers can no longer be used to sign in. A Redis outage at start-up no longer stops the Cockpit. The built-in Admin role can be assigned. Oracle TDE bundle fixes. Dependency security updates.

2.0.1

Released: 19 August 2026

• Fix. Web front-end container configuration.

1.0.1 / 2.0.0

Released: 17 August 2026

• CAP M365 Connector. An OAuth-bound vault key for SharePoint, Power Apps and Excel. Disabling the connector revokes its tokens.
• Vaults. New Managed Multi-Tenant MPC vault type.
• Certificate deployment. New targets: Nginx, Java Keystore, Windows CAPI and Forcepoint NGFW. F5, Fortinet and NetScaler connectors hardened.
• PKI. Certificate templates apply at issuance. The cert-manager issuer registration and its Certificates tab work end to end. ACME responses use absolute URLs. SCEP, CMP and EST enrolment hardened.
• HSM agents. Scoped policy authoring.
• DKE. Decrypt enforces crypto control policies and records the real caller in the activity log.
• Oracle TDE. The PKCS#11 library is built for Oracle Linux 7 (glibc 2.17). Bundle fixes for Windows and Linux.
• AWS XKS. Agent-backed vaults go through the HSM gateway, and key lookups are cached on the encrypt/decrypt path.
• Audit. The hash chain holds under concurrent writes. Retention purges run in batches. Health probes stay out of the audit trail. A host administrator can purge a tenant's audit trail.
• Permissions. View-only users no longer see edit and delete buttons, and every route and menu entry checks its permission.

1.0.0

Released: 9 August 2026

The first production release of Cockpit v2. It brought together:

Area	Included
Keys and vaults	Software Vault, DuoKey MPC KMS, Securosys, Sepior (Blockdaemon), on-prem HSM agents, cloud KMS and external secret managers
Integrations	DKE 365, Oracle TDE, SQL Server EKM, Azure EKM, AWS XKS, Google CSE, KMIP, SaaS BYOK and DSPM apps, Crypto Agility Plane (CAP)
PKI	CA lifecycle, ACME, EST, SCEP and CMP enrolment, certificate deployment (F5, Fortinet, NetScaler, Azure App Service, Entra ID App Proxy), ML-DSA and composite (hybrid) certificates, SSH certificate authority
DuoKey CPM	Cryptographic discovery (network, source code, dependencies, agents), CBOM, Quantum Risk Score report, compliance frameworks
Access and governance	RBAC with organizational units, ABAC access policies, passkeys and MFA, break-glass super-admin, hash-chained audit trail, OWASP ASVS dashboard
Automation	MCP server with capability packs, ServiceNow, Splunk and Vanta integrations, Terraform provider

Earlier versions

The earlier on-premise Cockpit Solution releases (1.4 and before) have their own notes: see OpenShift on-prem → Release Notes.

See Also

• Cockpit overview
• Access Policies
• Deployment