Horizon-cli 1.19.0 release notes

Netimport now supports Google Certificate Manager. The new netimport gcm command imports the certificates of a Google Cloud project into a Horizon discovery campaign. Learn more …​

WebRA challenge mode is now supported. webra enroll --challenge enrolls a certificate with a WebRA challenge and no credentials, and the automation module can enroll on WebRA automation policies configured with the challenge authorization mode. Learn more …​

ACME enrollments in the automation module now support IP identifiers (RFC 8738). IP SANs given with --ip are requested and validated with the http-01 or tls-alpn-01 challenge. Requires Horizon 2.11 or above. Learn more …​

automate modify can now run without interaction. The new --no-interactive, --ids, --serials and --reenroll options select the certificates to modify and re-enroll them without prompts. Learn more …​

Tenable.sc import can now read the cumulative database instead of a single scan with the new --cumulative option. Learn more …​

Nameshield netimport: imported certificates now carry the Nameshield certificate identifier in the nameshield_cert_id metadata.

automate modify now accepts --dn. The --c, --o and --ou options are deprecated in favor of --dn, and --prompt is deprecated and has no effect.

Certificate chains going through the eMudhra (emSign) intermediate CAs distrusted by the Go project are now rejected.

Fixed an issue where the --no-install option was not honored on two-step renewals in the automation module

Fixed an issue where the IIS automation did not target the existing HTTPS binding when no certificate was attached to it

Fixed an issue where the chain file of a KDB keystore was written in the wrong order

Fixed a panic when the CA chain response was empty or returned a non-200 status

Fixed a panic in automate request when a completed WebRA request had no certificate