Trust Protection Platform 16.4
Readme | November 2016

Trust Protection Platform 16.4 documentation
Pre-upgrade installation considerations
Multiple database instances
Upgrading from a previous version of Trust Protection Platform
Trust Protection Platform versioning
What's new in Venafi Trust Protection Platform 16.4
Resolved issues
Known issues
Features deprecated in this release
Features scheduled for deprecation in future releases
Customer Support
Trust Protection Platform 16.4 documentation
Starting in 16.4, the Server Agent readme information is combined with the Trust Protection Platform Readme.  For more information, see Server Agent.
You can now access all product documentation through the new Venafi Documentation Portal. 
To access the documentation portal:
1.	Visit https://docs.venafi.com (or https://documentation.venafi.com).
2.	Log in using your Venafi Training or FTP credentials. 
If you have not yet registered for a training account, visit https://training.venafi.com/user/register. 
3.	Choose the version of documentation that you want to view. 
Additionally, you can also find product documentation in the following locations and formats:
•	From the Help link in Aperture and the Web Administration Console.
•	On the Start Menu in the Venafi Programs folder.
•	Launch the WebHelp version of the Installation Guide by running the Installation Guide.lnk file included in the zip package.
•	The Venafi Trust Protection Platform Web SDK documentation is found in the following location:
 \Program Files\Venafi\Documentation\WebSDK\Default.htm.
•	PDF versions of the documentation are available from Customer Support.
Support is available through email.
Pre-upgrade installation considerations
Before upgrading your existing installations of Trust Protection Platform or the Server Agent, carefully review this section.
Trust Protection Platform
Refer to the following knowledge base article for a more detailed discussion of Trust Protection Platform upgrade considerations:
https://support.venafi.com/hc/en-us/articles/234806047
Note: Beginning with Trust Protection Platform 15.x, hardware requirements have changed. If you are upgrading from a version of Trust Protection Platform older than 15.x, please refer to the hardware requirements documentation for important information. Complete system requirements are detailed in the following help topic: https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-install-SysReq-ALLVenProducts.php 
Please review the following items before upgrading to Trust Protection Platform 16.4:
1.	You must have Microsoft .NET Framework version 4.6.1 (or later) on your Venafi Trust Protection Platform server prior to installation of the product. The installation files can be downloaded from this location:
 https://www.microsoft.com/en-us/download/details.aspx?id=49981
2.	The Microsoft Universal C Runtime update must be installed prior to installing Trust Protection Platform 16.4.  The update can be downloaded from this location: https://support.microsoft.com/en-us/kb/2999226.
NOTE (for Oracle Users) If you are using Discovery and your Oracle server is running on an AIX, Solaris or HP-UX host, the minimum supported version of Oracle is 11.2.0.4.
If you are using an Oracle database, you must have the Oracle ODAC 12c Release 3 (v12.1.0.2.1) client installed on your Trust Protection Platform server(s). 
While Trust Protection Platform 16.4 supports both Oracle and MS SQL as database platforms, Venafi will deprecate support for Oracle in version 17.1 (Q1, 2017). As such, new customers must deploy Venafi software using MS-SQL. For more information, see “Features scheduled for deprecation in future releases” near the end of this document. 
Server Agent
For upgrading the Server Agent to version 16.4, refer to the agent documentation in the online help section under “Upgrading the Server Agent.” For additional SSH configuration, refer to online help under "Discovering and remediating keys without the Server Agent."
NOTE You can view all documentation in either PDF format or by using the Aperture or Web Administration Console help systems. See “Trust Protection Platform 16.4 documentation”.
Considerations for preparing to install or upgrade
1.	To prepare for Server Agent installation or upgrade, navigate to https://docs.venafi.com/Docs/current/TopNav/Content/Agent/c-agent-install-Introduction-tpp.php   and click “Requirements”.
2.	If you want to discover and manage SSH assets, you must install Secure Shell (SSH). For example, install and enable OpenSSH or Tectia.
3.	Follow these requirements for using Certificate Authority (CA) issued certificates on the Venafi Trust Protection Platform server and recommendations for server certificates:
	Prior to the initial registration of the Server Agent, install root and intermediate CA certificates. For each device, install root and intermediate CA certificates in either the /var/opt/venafi/agent/data/curl-ca-bundle.crt or <install drive>\Program Files\Venafi\Agent\Data\curl-ca-bundle.crt.

- OR -

Let Aperture create the required signature of the Venafi Operational Certificate (VOC).  
b)	Intermediate CA and Venafi Operational Certificates are required to contain a Certificate Revocation List. (CRL) with a control distribution point (CDP) extension. One or more required CDP addresses that are valid and reachable by all agents via HTTP. Other CDP access protocols, such as LDAP, are not supported. 
Note: If your intermediate Root CAs do not have an HTTP CDP listed on the certificate or if your systems do not have network access to your existing HTTP CDPs, the CDP can be hosted on the Venafi Trust Protection Platform server. For more information, refer to the Venafi Server Agent Configuration and Installation Guide.
c)	All CRLs on CDPs must be valid. Intermediate CA and server certificates that are not revoked.
d)	The registration password must be configured on the Trust Protection Platform server for Server Agents to use to authenticate during the registration process.
4.	Use a supported operating system or platform. For more information, navigate to https://docs.venafi.com/Docs/current/TopNav/Content/Agent/r-agent-install-supportedOSes.php and click “Requirements”.

Multiple database instances
While Venafi Trust Protection Platform can run in multiple database instance environments, this installation is NOT supported. Customers using multiple database instances should work closely with Venafi Customer Support and/or Venafi Professional Services for the entire upgrade process.
For more information on using multiple databases with Trust Protection Platform, please read the following knowledge base article:
https://venafi.zendesk.com/knowledge/articles/227619928/
Upgrading from a previous version of Trust Protection Platform
When you install Trust Protection Platform you must be certain that the software you are installing is from Venafi and that it has not been modified. To help ensure that you are using legitimate Venafi software, Venafi uses a code signing certificate that identifies the software bundle as Venafi's and a Windows feature called “Strong Naming” to protect the integrity of the individual components. Cryptographic techniques are used to generate the strong names and best practices require Venafi to rotate the underlying keys regularly.  Accordingly, be aware that Venafi has updated the Strong Name keys starting with the 16.1 release, as follows:
•	Agent code signing keys have been updated starting with the 16.1 release.
•	The Strong Name update affects existing customers that use custom code with Trust Protection Platform.  After the update, any custom code that was compiled for the Trust Protection Platform 15.4 or earlier versions of Trust Protection Platform (prior to the 16.1 version) will need to be recompiled to be compatible with Trust Protection Platform 16.4.  
•	In summary, we expect the overall customer impact to be minimal. However, customers using custom code will have to recompile that code as part of the upgrade process.
IMPORTANT! If the system uses Windows Authentication, the user doing the upgrade also needs the same rights as that of the service account.
NOTE Security-related changes have been made that now prevent users from altering a certificate request after it has progressed beyond the start of the certificate renewal process.   Any certificates that are waiting for a new CSR to be uploaded prior to upgrading to 16.1 will require a reset and restart from the Web Administration Console after successfully upgrading Trust Protection Platform to complete the certificate renewal.
Supported Upgrade Paths
You can upgrade to Trust Protection Platform 16.4 from the following versions (and subsequent releases):
•	Trust Protection Platform 14.4.9
•	Trust Protection Platform 15.1.5
•	Trust Protection Platform 15.2.6
•	Trust Protection Platform 15.3.6
•	Trust Protection Platform 15.4.5
•	Trust Protection Platform 16.1.5
•	Trust Protection Platform 16.2.2
•	Trust Protection Platform 16.3
Any other version of the product must be upgraded to one of these supported versions.  For example, if you are running Trust Protection Platform 14.1, you must first upgrade to version 14.3, install the upgrade packages to version 14.3.11 (or later), run the database upgrade scripts, and then install Trust Protection Platform 16.4.  See https://support.venafi.com/hc/en-us/articles/ 220710528 for the upgrade table.
To upgrade Trust Protection Platform
1.	Back up the Trust Protection Platform database.

2.	Stop IIS.

3.	Stop all Trust Protection Platform services.
⦁	Stop the Venafi Trust Protection Platform Service.
1	Stop the Venafi UniCERT Interface Service, if present.
2	Stop the Venafi Log Server Service.

4.	Close any browsers that are logged in to User Portal, Aperture, or the Web Administration console.

5.	Repeat steps 2 and 3 on all Trust Protection Platform servers to ensure all Venafi-related services are stopped prior to continuing with step 6.

IMPORTANT! Do *NOT* uninstall the previous version of Trust Protection Platform. The previous version of Trust Protection Platform is automatically uninstalled during the installation process.

IMPORTANT! If you are upgrading from version 16.1.0 or earlier: As of 16.2, the Venafi Platform uses new permissions for the Database Service account. The new permissions are in addition to the Execute and Receive Permissions that were required previously. For an example of how to apply the newly required permissions to your service account, see the sample-grants.sql script in the '/Database Scripts' folder at the root of your installation zip folder.

6.	Run all necessary scripts against your database. Begin with the script matching your current version of Trust Protection Platform and then execute each script in the order listed below. For example, if you are running Trust Protection Platform 14.4 with MSSQL, run these scripts in this order:   
a.	mssql_update_14.4_to_15.1.sql, 
b.	mssql_update_15.1_to_15.2.sql,
c.	mssql_update_15.2_to_15.3.sql,
d.	mssql_update_15.3_to_15.4.sql,
e.	mssql_update_15.4_to_16.1.sql,
f.	mssql_update_16.1_to_16.2.sql,
g.	mssql_update_16.2_to_16.3.sql
h.	mssql_update_16.3_to_16.4.sql
IMPORTANT! If you get an error during any of the database script upgrades, do not continue the upgrade. Contact Customer Support for assistance. 
To locate these scripts 
Unzip “Venafi Trust Protection Platform 16.4.0.zip”. Then go to the following folder:
\Database Scripts\MSSQL\Updates

Oracle update script information
IMPORTANT! If you are a current Oracle customer, you will need to contact customer support to get the Oracle Update scripts. The scripts are not included in the “Venafi Trust Protection Platform 16.4.0.zip” file.
Please send an email to support@venafi.com requesting access to the scripts and a Venafi representative will reach out to you to assist with the request.
Remember, support for Oracle will end with Trust Protection Platform 17.1. For more information, see the “Features Scheduled for Deprecation in Future Releases” section near the end of this document. 
7.	On the Trust Protection Platform server that hosts your Log Server, launch VenafiTPPInstallx64.msi with elevated admin privileges (e.g., Launch Command Prompt with “Run as Administrator” and launch the installation MSI file) and complete the onscreen walkthroughs, per your environment's requirements. Repeat this step on all remaining Trust Protection Platform servers.

8.	After installing Trust Protection Platform 16.4, start the Trust Protection Platform and IIS services on each server that was stopped in steps 2 & 3. Start the Venafi Log Server service first. 
IMPORTANT! If you are using the Adaptable CA driver you must update the definition of the Prepare-ForRequest function in your PowerShell scripts to include the "$Specific" as shown below.  This change makes additional data available to that function so that it can support more use cases. (Updates in bold red font.)
function Prepare-ForRequest
{
  Param(
    [Parameter(Mandatory=$true,
      HelpMessage="General Parameters")]
        [System.Collections.Hashtable]$General,
    [Parameter(Mandatory=$false,
      HelpMessage="Function Specific Parameters")]
        [System.Collections.Hashtable]$Specific
  )
Trust Protection Platform versioning
Venafi Trust Protection Platform 16.4.0 is a minor release in the Venafi release cycle.  For information about Venafi's current release model as well as the duration of engineering support for this release, please see the following Venafi knowledge base article:
https://support.venafi.com/entries/23267241
What's new in Venafi Trust Protection Platform 16.4
For information about what’s new with this release of Trust Protection Platform, see the What’s New in 16.4 topic in the Aperture and Web Administration Console Help systems and in the Trust Protection Platform Product Overview Guide.pdf. 
Aperture
Certificate File Upload
When using Aperture, you can now upload a certificate via a file, copy and paste, and drag and drop. (@18804)
Object Rename
Aperture users can now rename certificates, devices, network discovery, agent groups, and custom reports in a uniform way. (@23957)
Sticky Columns
Certificates, SSH Keys and Agent lists now preserve column selection and order.
Standardize Certificate Actions
Updated logic and moved certificate actions to the “Actions Menu” on certificates. Actions can also now be done on the Inventory list. (@13415, @23196)
Server Agent
Solaris 11 SPARC support 
Server Agent support has been added for Solaris 11 SPARC. (@19354)
Server URL field is no longer required
Because of various issues caused by either modifying or incorrectly entering the Trust Protection Platform server URL, the Server URL field is no longer required.
SSH
SSH Key HSM Encryption
Support has been added for key material encryption with the custom symmetric key (such as the one stored on HSM). (@18753)
Encrypted Key Display
Trust Protection Platform now shows all encrypted private keys (including ones that have not been matched to public) in keyset list.
z/OS Support
Support has been added to SSH agentless discovery and remediation for z/OS devices.
Out-of-sync Violation
A new violation (status) showing when keys in a keyset have been discovered after the keyset has been rotated, causing them to be out of sync.
Platform Drivers
F5 One-Cert-to-Many SSL Profiles
You can now use the new F5 driver option to provision a single certificate to many F5 profiles. For more information, see the topic, "F5 LTM configureation-overview" in the user Help and documentation.
In addition, the Venafi F5 driver now supports F5 version 12.x. (@15117, @10995, @11822)
Entrust.NET: reissuance support has been added
You can now submit certificate requests that are outside of the renewal window for reissuance rather than renewal.
JKS – Support for 1.8
You can now rotate keystores that are using version 1.8 of Java Key Stores (@19576, @16111, @23483)
Effective Rights API 
The Permissions API allows you to determine local and external provider identity rights for managing certificates. For example, you can use a REST API call on Active Directory (AD) to determine group or individual rights to certificates.
To learn more, see "GET Permissions/Object/guid/local" or "GET Permissions/Object/guid/external".
Resolved issues
Throughout the rest of this document, tracking and bug numbers are contained in parenthesis to allow you to track issues and enhancements across releases. Numbers starting with a hash symbol (#) indicate internal Venafi tracking numbers. Numbers starting with the at symbol (@) indicate the incident number issued by support.venafi.com.
The following issues have been resolved in this release of Trust Protection Platform:
Aperture
•	The Per Page control in the Log View now reflects the correct number of records when the GridPageSize attribute is included in web.config. (#28708) 
•	In Aperture, the Renew button is now disabled (greyed out) when User Provided CSR is locked at the policy level. (#28573) 
•	Users in Aperture that are given view/read/associate to the installation are sometimes shown the button to "Validate Installation".  This option has been removed for users with that specific combination of permissions. (#30374)
Certificate Authority
•	GeoTrust TrueFlex no longer supports SHA-1, the UI default. Both GeoTrust TrueFlex and GeoTrust Reseller CA templates in Trust Protection Platform no longer offer SHA-1. (#25120)
•	Thawte CA – no longer reports incorrect status in WebAdmin UI when enrollment fails. (#25770)
•	Thawte no longer supports “SuperCert” certificate type, which has now been removed. (#25859)
•	Uninstalling Trust Protection Platform now correctly removes the Amazon CA icons. (#25988)
Certificate Manager (Server Cert)
•	The Validate SSL/TLS Connections for this Certificate option is no longer available in Aperture when it is locked at the policy level. (#30832)
•	The Last Validation Check field is now updated correctly when validation fails due to processing engine restrictions. (#30589)
•	Duplicate serial numbers no longer cause a certificate to be hidden on the Certificates page of the CA template. (#29649)
•	A new log event has been added for when a certificate is archived. The new event is EventID - 000900C7 Event Description – “Certificate Manager - Certificate Archived. (#29266)
•	After upgrading Trust Protection Platform from 15.1.x to 16.1, revoking from Symantec MPKI could break if the CA certificates had not been associated with the Symantec CA Template. This issue has been resolved. (#28892)
•	Could not reproduce an issue reported where the revocation process threw an Index Was Out of Range error. (#28734) 
•	CA Import no longer fails (with the error, "There was an error writing to the pipe: The pipe is being closed. [232, 0xe8]."). (#28137) 
•	An issue was reported that you should not attempt to use the Server Agent to install a certificate if Trust Protection Platform did not have the private key for that certificate. This issue is resolved. (#27511)
•	Roots tree now chaining correctly with non-blacklisted root certificates. (#27506 ) 
•	The Web Administration Console (WebAdmin) allows uploading a user generated CSR with a common name containing '<' and / or '>' characters. This works as designed. (#27100) 
•	Shortened discovery IP address range is now correctly interpreted by the Web Administration Console (WebAdmin). (#27083) 
•	The options to generate and reuse private keys were removed from Aperture to support policy settings made in respect to User Provided CSR usage. (#26526) 
•	CA import now correctly imports the DNS SANS values along with other certificate values. Other SAN types are not currently supported. (#26203) 
•	Association not showing up under Consumers when adding associations is expected behavior. No changes were made. (#25764) 
•	Debug event "Certificate Manager - Certificate Process Error" modified to be an Error Level event. (#24365) 
•	Could not reproduce an issue that indicated that creating a scheduled network discovery in the Australian time zone resulted in an incorrect schedule. No changes made. (#21514)
Reporting
•	Scheduled reports are no longer sent by all servers where the reporting module is installed. (#30634) 
•	When clicking Run Now, duplicate entries for Report Initiated events no longer occur. (#19679) 
LDAP Driver
•	LDAP driver documentation has been updated to include previously missing reference material, including search string methodologies. (#30700, #28120) 
Notifications and Logging
•	DSN options are now passed to the DB Schema validation function, as expected. (#30679)
Platform Drivers
•	Provisioning to NetScaler no longer fails when trying to write a chain containing spaces in the certificate key name. (#30178)
•	F5: Onboard discovery now stores the Public key Hash when importing a discovered certificate. (#30833)
•	F5: Changes made during provisioning are lost if F5 is subsequently rebooted (#30602)
•	F5: When provisioning to F5 if the failover state is a mismatch, we retry indefinitely (#30582)
•	CAPI: Double Negative; "Non-Exportable" field on CAPI Application Object Type. (#28686)
•	JKS: Need 1.8 added to the list of supported versions. (#26159)
•	F5: Provisioning same key on a FIPS-enabled F5 throws an error about the key already being in FIPS. (#26156)
•	Comodo CCM credentials fail, then require a restart to renew. (#25390)
•	Stage 805 and 810 for F5 provisioning is writing the cert and key file too many times. (#25104)
•	F5: Error "Connection to 10.117.15.7 failed with error: The request was aborted: Could not create SSL/TLS secure channel" continues to retry every 2 to 3 minutes. (#24473) 
•	When using the F5 LTM Advanced driver on a v12 F5, a certificate push after new no longer fails if the same certificate is associated with more than one application for all but the first application in the list. (#24357)
•	Could not reproduce this issue: The GSK driver is unable to validate or provision CMS keystores when the certificate is configured to generate the CSR and private key on the application. (#24833, #24835)
•	The issue where the F5 driver continuously tries to resolve a connectivity error in order to resolve availability problems that are common to the F5's iControl interface when it is under load has been resolved.  . (#24911)
•	You can now push certificates using GSK v7.0 and v8.0 tools even when the certificate label contains spaces. (#24834)
Reporting
•	When a job is waiting in memory and the Venafi services are restarted, the report is no longer lost. (#19685, @13455)
•	If a user is deleted from Trust Protection Platform, custom reports created by that user are now reassigned to an existing user rather than failing. (#30248)
Schematool
•	Schematool importing validation results no longer include a lone $ (dollar sign) that had attempted to substitute. (#30768) 
Server Agent (Client Subsystem) 
•	Client Trust Bundles are no longer sent down each time the VEDClient App pool is restarted. (#27215) 
•	When Server Agents do not belong to any group, users with view/read config permissions to \VED\Client, and who are assigned through Aperture’s Agent Registration Permissions, could not see any agents. This has been fixed. (#23320)
•	In some test cases, the Server Agent failed during certificate discovery on 32-bit versions of Windows. The root cause was discovered and has been fixed. (#31294)
•	Setting chattr +i on a keyset file and then rotating the keys had been found to cause a seg fault on the Server Agent running on the Linux platform. This issue has been fixed. (#31317)
SSH
•	Scanning symbolic links now returns keys correctly. (#30876) 
•	Agentless SSH discovery now works properly on older versions of Linux with core version 2.6.x and earlier (such as OEL 5.5), which returned "Agentless SSH Access Failed to Incorrect return code (-1)". (@23517, #30826) 
•	Keys that were discovered with Agentless discovery will be left alone even if they are no longer in search paths. (#22413) 
•	A new Out of Sync violation has been implemented to resolve this issue. For more information, see “Remediating Out of Sync violations” in the Aperture Help system (#30029). 
Venafi Updater
•	If the Venafi Updater fails to replace venafi.core.dll, it now reports the correct status. (#26468) 
Web Administration Console (WebAdmin)
•	The Web Administration Console dashboard now loads data correctly, as expected. (#30901)
•	The RA Certificate label found on the Platform > Network Device Enrollment page was misleading and has been relabeled, “RA Certificate Credential.” (#27728) 
•	Double-negative labels on View Tab > Export Columns in the Web Administration Console (WebAdmin) will not be modified; recommend using Aperture where this design issue has been addressed. (#27580) 
•	Blank Custom list omits results from the View tab is an issue that could not be reproduced. No change was made. (#25102) 
Known issues
Aperture
•	If a Discovery job is created using invalid characters, you will receive a message, “Failed renaming discovery job.” Try a simple name without invalid characters, e.g. < />. (#15183)
•	Installing Aperture on a different server than Web Admin results in product documentation not being available for Aperture. If Installing Aperture on the server, make sure Web Admin is available also. (#12485)
•	Global searches will not find SSH key names. Use the key lists and filters to find your SSH keys. (#17096)
•	A user with limited permissions to Agent Group but not Agent Work who deletes an agent group will leave orphaned objects. If you assign 'Delete' permissions to a user in managing groups, make sure you also assign them 'Delete' permissions to work management as well. (#25495)
•	The Aperture Device inventory field label is incorrectly labeled “Hostname/IP.” It should be the Friendly name/Object name. (#22141)
Certificate Authority
•	The Entrust CA occasionally reports a failure at stage 500 but still creates the certificate on the Entrust site. Download the certificate and import it to Trust Protection Platform. (#19248, @13013)
•	The MSCA has an encoding issue with UPN SANs when using user provided CSRs. Extra character(s) are added to the email address. Delete the extra character(s). (#23683, @17181)
•	When doing a mass enrollment of some certificates to the Symantec CA, some of them receive the error, “Retrieve Certificate Failed with error: The request was aborted: Could not create SSL/TLS secure channel.” The certificate is retrieved but the error is not cleared. (#24310, @17584)
•	With a VeriSign or Entrust.NET certificate object, after a specific End Date is entered, cannot be erased. If the end date needs to be removed, a new object will need to be created.  (#13541)
•	Red Hat CA - SANs missing from certificate when using Service Generated CSR. (#23542)
•	The MSCA listener process starts whenever an MSCA cert is viewed and then stays open for much longer than expected. (#23468)
Certificate Manager
•	Adding root certificates in a different order will result in a different chain. Venafi is working on a resolution for the issue. If a particular root or intermediate certificate is not desired for use in chains, the root or intermediate should be imported to the roots tree and marked as blacklisted. This will prevent it from being used in any chain building (#10001, @6376)
•	Certificate creation with user-provided CSR containing SANS does not take into account SANs from Additional Info panels. (#26607)
•	Certificates with multiple CN elements can break the certificate grid view in Web Admin. (#25910)
Client Subsystem
•	Parsing of Membership Rules for a group fails if it encounters unknown or unresolvable identities. This typically occurs when you reference a User or Group that has been deleted from Active Directory or LDAP.  Remove the Group or Users from your rules and membership processing will continue (#27635)
•	User Certificate Work configuration doesn't update after setting new Group Membership rule. (#27017)
Core
•	Certificates that don't have an issuer field populated can cause errors in the logs. (#21613)
•	Unable to page through logging if there are more than a few hundred pages. Use filtering to reduce the number of pages to page through. (#18759)
•	Master administrators lose revoke permissions if they belong to a group that does not have revoke permissions. (#31328)
Dashboard
•	If you move the certificate or SSH trends reports from their default location, then your trends widgets in Aperture will not function. (#15482)
Discovery
•	If the Agent is told to scan from the root of the file system, it will scan the agents' trust bundle resulting in Trust Protection Platform-side applications.  If scanning from the root, please exclude the installation folder of the agent. (#26540)
Enterprise Mobility
•	If using the End User Portal, when users hit their download limit, they will receive an unhandled error on screen instead of the expected error message.  If your goal is to remove the download limit, instead of setting it to 0, as documented, set the download limit to something high like 999999. (#30380, #30381)
•	HTML does not work in the instructions section when setting up the portal task object. (#15540) 
Installation
•	Venafi Control Center (VCC) can't create an operational certificate if the default policy target has been changed and you are adding another server to an existing Trust Protection Platform server environment. (#13682)
•	If Venafi Control Center (VCC) is unable to connect to the database during the “configure products” portion of the VCC wizard, you will be prompted to enter the DPAPI key. Fix the database connection and rerun the VCC wizard. (#18029)
•	Venafi Control Center (VCC) configuration fails if the database name contains a “.” (period). (#19470)
Notifications
•	Combining AND & OR in a Notification Rule only uses the last defined condition. It is possible to get the desired result by dividing up each OR condition and then duplicating the desired AND condition for each OR condition, e.g. if [condition 1] matches [value 1] AND <my desired condition> OR [condition 1] matches [value 2] AND <my desired condition>. (#18798)
Platform Drivers
•	Several Application drivers do not support remote key generation of SHA-2 hashing algorithm. The drivers that do not allow this are: Apache, Brocade, Cisco ACE, Data Power, F5, GSK, iPlanet, JKS, NetScaler, Palo Alto Networks, and PEM.  (#18845)
•	If there are GSK objects which have a DN larger than 100 characters, the upgrade script to 16.1 may fail. Truncate the GSK objects to less than 100 characters. (#21021)
•	Brocade - File Validation incorrectly reports 'No Certificate Found' when chain is provisioned.  However, because the Brocade driver will be deprecated in Trust Protection Platform 17.1, this issue will not be fixed. (#26019)
Reporting
•	The CA Trust Report does not work. As a work-around, set your Trusted Issuers at the root of the Policy tree to keep track of the issuance of trusted versus untrusted issuers. (#31289)
•	Values for scheduling are not reflected in the logs when saving a report. The values show as “0”. (#14156)
•	Reports are pulling in data from two policy folders that have nearly identical names where the only difference is a suffix on one of the policy names. As a work-around, place a different character in the middle of the second policy name to prevent the issue. (#22216, #23981, @15354)
Server Agent
•	False "ClientRest - VOC Error" messages are logged instead of "SSL certificate chain verification failed" message. The problem occurs when Server Agents are communicating with a Trust Protection Platform server while using a trusted Self-Signed Venafi Operational certificate. Either ignore the errors or use a VOC certificate that is issued by a trusted Certificate Authority (#30026).
•	Sorting on the "Manual CSR Required" column does not function properly. Please sort your views and reports on a different column (#27827).
•	Asterisks (*), which are unnecessary with the "Like" operator, cause problems with group membership calculations. When using the "Like" operator in Agent Group Membership, users should never use asterisks. An error message has been implemented in Aperture to instruct users not to use an asterisks (*) when configuring Group Memberships. (#28959)
•	While not an issue, note that certificate discovery using the Server Agent on Windows 32-bit platforms can take up to 40 minutes or longer to complete. 
SSH
•	The 'Last Rotated' time shown on a keynote is displaying the time the rotation was initiated rather than when the actual file operation occurred. (#17262)
•	With Public key instances, clicking edit and saving without making changes will start provisioning. Click cancel or don't save to avoid this unnecessary provisioning. (#13347)
•	OpenSSH known host key comments are not restored in case they were manually edited on the host working under TrustForce security level. (#19793)
•	“Key Older than Allowed” violation is incorrectly erased by automatic revival of key that was manually edited on the host working under TrustForce security level.  (#17437)
•	Remediation interval not honored when agentless remediation is used. (#19805)
•	Known host keys are duplicated if hostname is changed while in Remediate. (#19791)
•	Unless you have Delete permissions on a policy folder, you cannot cancel the Add New Instance operation. (#18506)
•	Adding additional private key requires user to have the View permission in addition to the Private Key Read permission. (#18504)
•	With Agentless SSH key discovery, the 'Exclude paths' is not excluding the directory with wildcards, such as /home/*/test. (#22194)
•	SSH keys on device will be re-discovered and duplicated if connection interface is changed from Agentless to Agent. To remove the 'Agentless' discovered keys, delete the device object created by Agentless discovery using Web Admin or Web SDK. 
•	When configuring sudo settings on a device object (related to certificate provisioning drivers), the Use Sudo and Sudo Credential fields are for future use; therefore, Use Sudo can only be set to No.  
•	When the database server is out of disk space, attempting to view a keyset display takes you back to the keyset list. (#25581)
•	On an agentless device, an empty authorized file is shown in Aperture for Tectia 4 and 5 keys. Policy is set to Detect mode. (#27641)
•	After creating Tectia 4x keys, after every discovery session, a set of log events is generated: SSHManager - Key Instance Created Based On Discovery, even though no new keys have been created. (#27578)
•	Keys with multiple newlines and comments at the beginning of the key file are not discovered. (#29738)
Web Administration Console
•	If you blacklist a certificate, the intermediate certificates will not chain up to the correct root in the Tree View. This is a cosmetic issue. It is chained to the correct (not blacklisted) certificate. (#18717, #21995, @12657, @15336)
•	You may get a 'HandshakeFailure' error when performing onboard validation to Layer7 gateways. This is caused by setting the Layer7 to require SSL. The driver needs to be updated to support this setting. (#25125, @18582)
•	We have had reports of the Venafi Operational Certificate being randomly replaced. Please contact Venafi Customer Support if you experience this issue. (@14465, #22260)
•	Cannot log in to the Web Administration Console as an ODSEE user when your user name contains the less-than sign (<). (#30642)
•	Cannot log in to the Web Administration Console or Aperture as an Active Directory (AD) user using a prefixed name with a SAM account name containing the at symbol (@) or DN containing a colon (:) or semicolon (;). (#30644) 
Venafi Web SDK
•	Identity and browse doesn't return the identities containing some special characters. (#30643)
Features deprecated in this release
This section describes those features that are no longer supported or available in the current release.
•	The VED Client Portal has been deprecated in this release of Trust Protection Platform. This tool was never officially supported or documented.
Features scheduled for deprecation in future releases
This section describes features that are schedule to be removed from the product or no longer supported for a targeted future release.
Release 17.1
•	Oracle database support: Beginning with Venafi Trust Protection Platform 17.1, Oracle will no longer be supported as a database platform; as of version 17.1, Microsoft SQL Server will be the only supported database platform. Oracle will continue to be supported with version 16.4 (and earlier) until each of these respective releases is no longer supported. 

Venafi supports each Trust Protection Platform release for two years. This means, for example, that version 16.4 will be supported through December 2018. Consequently, if you are an Oracle customer using version 16.4, you have until December 2018 before you must migrate to Microsoft SQL Server.

You will be required to migrate to Microsoft SQL Server before you can upgrade to version 17.1 or later. Because Venafi is continually adding features that enable you to better secure and protect your keys and certificates against escalating threats and risks, Venafi strongly encourages you to upgrade to newer versions of Trust Protection Platform as soon as possible. 

MIGRATION SUPPORT:  Venafi Customer Support will provide you with a migration utility and support to ensure you successfully migrate your existing data from Oracle to Microsoft SQL Server. This migration utility will require that you be running Trust Protection Platform versions 16.3 or 16.4. 

Please contact Venafi Customer Support for the migration utility and assistance in migrating from Oracle, or with any questions regarding this change in database support. 

For more information, refer to: 

https://support.venafi.com/hc/en-us/articles/227567188

•	Brocade: This is a legacy application driver that is incompatible with current ServerIron versions. In addition, Brocade had announced an end-of-life for the ServerIron product in January 2016.

•	Verizon SureServer: Verizon sold their public trust business to DigiCert in June 2015 and all SureServer customers should now be using DigiCert. Therefore, this CA driver is no longer required.

•	Citrix NetScaler Driver: This driver will be transitioned from SSH CLI to the Nitro API. NetScaler versions prior to 10.5 will no longer be compatible or supported. Versions tentatively being targeted for support are 10.5 and 11.1.
Release 17.3
•	SQL Server 2008 R2 will be removed as a supported database platform for Trust Protection Platform. SQL Server 2012 and 2014 will be supported and 2016 will be compatible.
See: https://support.venafi.com/hc/en-us/articles/227561987 
•	Windows Server 2008 R2 will no longer be supported as an operating system.
See: https://support.venafi.com/hc/en-us/articles/227629368 
Ongoing migration of features
Windows Administration Console features will continue to be migrated to Aperture and the Venafi Control Center user interfaces.
Customer Support
For assistance, please contact Venafi Customer Support:
URL: http://support.venafi.com
Email: support@venafi.com
Phone: 877.266.5159

THIS DOCUMENT AND THE SOFTWARE IT DESCRIBES ARE COPYRIGHTED BY VENAFI 2016. ALL RIGHTS RESERVED. YOU HAVE RECEIVED THIS INFORMATION IN ACCORDANCE WITH YOUR SOFTWARE LICENSE AGREEMENT. YOU ARE NOT AUTHORIZED TO DISTRIBUTE THIS DOCUMENT, THE SOFTWARE IT DESCRIBES, OR ANY OTHER INTELLECTUAL PROPERTY OF VENAFI OUTSIDE OF YOUR ORGANIZATION WITHOUT THE WRITTEN CONSENT OF VENAFI.