An update (6.5.2) for the CipherMail Gateway is now available.

Today we are releasing CipherMail Email Encryption Gateway 6.5.2.

Security & Hardening

• Limit the PDF Password Length setting to 10 to 32 bytes; a short password left an encrypted PDF open to offline guessing by whoever holds it. A value outside the range is refused when set. A value stored before this release is still used, with a warning in the log on every use, until it is changed. The default of 16 is unchanged. The lower bound can be changed with the system property ciphermail.pdf.min-password-length (ciphermail_backend__user_defined_system_properties).
• Require a manually set client secret (client-secret) or OTP secret key (pdf-otp-secret-key) to have the form of the generated value: base32 of at least 26 characters. Any string was accepted, and a guessable key gave away the password of every OTP PDF of the user and let the portal tokens of the user be forged. Neither needs setting. A value set before this release is still used; clear pdf-otp-secret-key to return to the derived key.
• Apply the Name Constraints extension of a root certificate to every certificate of a chain built to it. The extension was ignored on a root; only the constraints of intermediates were applied. A chain which violates the constraints, or a root whose constraints cannot be decoded, is no longer trusted. Remove a constrained cross-certificate from the roots when the unconstrained root is also trusted. To restore the old behaviour, set the system property ciphermail.certpath.check-root-name-constraints to false.
• Only accept an email address which is written as a plain address. An address with a display name, a comment or angle brackets, such as bob@victim.com(x).corp.com, was reduced to the address in front of it, so a certificate could be stored and selected for an address it does not contain. Such an address is now invalid wherever the gateway validates one: certificate addresses, user names, recipients and settings. The System Email From setting may still carry a display name, and the comment form of a PGP user ID (bob@example.com (work key)) is still reduced to the address. A stored certificate keeps its addresses until it is imported again.

Changes

• The certificate tables of the admin UI and the certificate details of the REST API (nameConstraints) show the Name Constraints extension of a certificate.
• Create Local CA, the REST API (permittedEmailNames and excludedEmailNames) and the CLI (ca create root|intermediate --permitted-email-names ... --excluded-email-names ...) can give a root or intermediate CA a Name Constraints extension on email names: an address, a host or a domain (.example.com). The extension is critical, so a client which does not support Name Constraints rejects certificates issued by such a CA.
• The dracut-config-generic package is only installed on the virtual appliance images, which must boot on any hypervisor. A gateway installed on an existing AlmaLinux or RHEL machine no longer gets it, as the generic initramfs it produces fills up /boot. An existing installation keeps the package.
• The number of kernels dnf keeps installed (installonly_limit in /etc/dnf/dnf.conf) can be set with the Ansible variable ciphermail_appliance__dnf_installonly_limit. The default of 3 is unchanged.
• The virtual appliance images are built with a 2 GB /boot partition instead of 1 GB. With the generic initramfs of the image, three kept kernels sometimes did not fit during a kernel update. An existing appliance keeps its 1 GB partition; the Update chapter of the administration guide describes how to recover a kernel update which failed for lack of space in /boot and how to keep fewer kernels.
• The Since and Until fields of the log viewer default to 1 hour ago and now instead of being empty, so opening the page shows the last hour instead of the last 10000 lines of the journal. The values are passed to journalctl as-is, so any journalctl --since expression can be entered.
• The Hyper-V virtual appliance is a VHDX file instead of a VHD file and runs as a Generation 2 virtual machine. It still runs as a Generation 1 virtual machine. A Generation 2 virtual machine only starts with the Secure Boot template "Microsoft UEFI Certificate Authority" or with Secure Boot disabled; see the Hyper-V chapter of the virtual appliance guide. All virtual appliance images now boot with UEFI as well as BIOS. An existing appliance keeps its generation and its partitions.
• Update dependencies.
• certificate sync-keys-from-keystore (POST /api/certificate/syncKeysFromKeystore) no longer takes a store and always syncs the certificates store. A sync of the roots store added every certificate with a private key to the roots and made each a trust anchor. Remove such certificates from the roots when a sync of the roots store was ever run. A script which passes --store must drop the option.

Bug fixes

• On Oracle, searching certificates by subject or by issuer in the admin UI, the REST API or the CLI failed with Parameter 1 of function 'lower()' has type 'STRING', but argument is of type 'java.lang.String' mapped to 'CLOB'. PostgreSQL and MariaDB were not affected.
• Deleting a certificate, from the admin UI, the REST API or the CLI, now also deletes its private key, unless the same certificate is still in the other store. The key stayed in the key store, and certificate sync-keys-from-keystore added the certificate back. A deleted key cannot be restored, so export a certificate with its key first when it may be needed again. certificate orphaned-keys lists the keys of certificates deleted before this release, and keystore delete deletes one. A certificate which is in use, the local CA certificate included, is refused before anything is deleted. When the key store refuses to delete the key, as some HSMs do, the certificate is kept; set ciphermail_backend__ignore_key_delete_failure to true to delete the certificate and keep the key.
• A route of the admin UI, the portal or the company portal, such as /success to which the back-end redirects after a login, is now served as index.html with status 200. The web server answered such a route with a 404 whose error page was the app, and a proxy in front of the gateway could replace the 404 with its own error page. A missing file below assets/, locales/, style/ or /.well-known is still a 404, so a missing locale still falls back to the next one and a missing security.txt is not answered with the app.
• The Sign Header and Sign Subject Regex triggers now also force PGP signing. The triggers only skipped the S/MIME Skip Sign Only setting, so a message of a sender without an S/MIME signing certificate, or with S/MIME disabled, was not signed when PGP Skip Sign Only was enabled. PGP must still be enabled for the sender and the recipient. When both triggers match, the subject keyword is now removed as well.
• Release notes