Endpoint Credential Manager 1.6.2609 release notes

🆕 New features

Certificate validation settings

Two new settings let you control how ECM validates the appliance certificate on hosts where a full chain of trust or a published revocation endpoint is not available.

requireCertificateRevocationCheck — default false. When enabled, ECM rejects a certificate whose revocation status cannot be determined.
allowUntrustedApplianceCertificate — default false. When enabled, ECM accepts an appliance certificate that does not chain to a trusted root, for hosts where the issuing CA certificate is not yet installed.

🚧
ECM does not verify the appliance identity while allowUntrustedApplianceCertificate is enabled. Use it only until the issuing CA certificate is installed on the host.

Diagnostic settings for field debugging

New settings help you diagnose credential retrieval and plugin behavior without a rebuild.

MaxReturnedCredentials — the credential result limit is raised to 750 and can now be overridden in configuration rather than requiring a rebuild.
VerbosePluginExceptions — returns full plugin exception text to the appliance for field debugging. By default, plugin failures return a correlation ID instead.
Every appSettings key that ECM reads is now documented in Example.config.

✨ Enhancements

Hardening of plugin, protocol, and token handling

Several changes reduce the information ECM exposes and the work a malformed request can cause.

Plugin failures return a correlation ID to the appliance rather than full exception text. The exception detail is written to the ECM log instead.
The protocol version response is length-bounded, and a failed protocol version parse is now handled rather than propagating.
A quadratic-time path that a malformed protocol message could use to consume disproportionate CPU is removed.
The ECM service and the Configurator pin their working directory to the install directory.
OAuth response bodies are no longer included in exceptions surfaced to logs.

🛠️ Issues resolved

Product area	Description	Resolution
Authentication	ECM refused the appliance connection when it could not determine whether the certificate had been revoked. This is the common case for certificates issued by an internal CA such as Active Directory Certificate Services, or by any CA that does not publish a CRL distribution point.	ECM now completes the connection when revocation status cannot be determined. A certificate positively known to be revoked is still rejected, and is now identified as such in the log.
Authentication	Certificate validation failures gave no indication of which check failed or which certificate in the chain was at fault.	Validation failures now log the specific policy error and the status of each certificate in the chain.
Logging	An unencrypted credential in the Azure Table Storage or ADO.NET appender configuration caused that log destination to be dropped silently, with no error to indicate that logging had stopped.	The credential is now used and a warning is logged.
Configuration	Changing the log level in the Configurator had no effect, because the change was not written to the configuration file of the running application.	Changing the log level now writes to the configuration file of the running application.

📝 Requirements

Microsoft .NET Framework 4.8. Confirm it is installed before upgrading.
Compatible with any BeyondTrust Secure Remote Access version that supports ECM protocol versions 1.4, 1.5, or 1.6.

🗒️ Notes

No configuration changes are required. Existing appSettings, log4net appenders, and proxy settings are preserved.
This release supersedes two upgrade notes from 1.6.2606. CRL and OCSP endpoints no longer need to be reachable. Plaintext appender credentials no longer need to be re-encrypted before upgrading. Both conditions now produce a warning rather than a failure.
An appliance certificate that has actually been revoked is rejected. Builds earlier than 1.6.2606 accepted a revoked certificate because they performed no revocation checking.
The SHA-256 signature for ECMBundledInstaller.exe is: 4e108ed8bbf1d2468a10506c7c9691bedf1179b609e53dca3dcfe34aa81d7942

⏰ Deprecation notices

Unencrypted credentials in the Azure Table Storage and ADO.NET log appender configurations are accepted with a warning in this release. A future release will require these values to be DPAPI-encrypted. Encrypt them now to avoid losing those log destinations on a later upgrade.