Release Notes - Certify Management Hub

7.4.0 : 2026/10/22

Enhancements:

• Certificate requests: new dns-account-01 challenge type (IETF draft), a variant of dns-01 whose TXT record name is specific to your ACME account, so several ACME clients or accounts can validate the same domain at the same time without overwriting each other's records. The challenge settings show the account specific record name for CNAME delegation, for the CA you select
• Managed challenges: hub managed challenges now accept dns-account-01 records, with the same CNAME delegation rules as dns-01
• Certificate requests: dns-persist-01 now supports the latest draft, including hashed account values, and builds records in the form the CA's directory asks for. Record Options choose the CA account (one entry per CA), issuer domain name, wildcard policy and an optional persistUntil date, and Test checks the records you created
• Certificate requests: before validation, dns-persist-01 records are now looked up and checked against what the CA will accept. A missing or unsuitable record, such as one for a different account, without policy=wildcard for a wildcard certificate, or past its persistUntil date, is logged as a warning giving the record the CA would accept. The request still goes ahead, as the CA makes the final check
• Stored credentials: a secret field, such as a password or client secret, can now take its value from an API Key or Token stored credential on the same instance, so one secret can be shared by several credentials and renewed in one place. A credential in use this way cannot be deleted, and exporting the credentials your certificates use includes the credentials they take values from
• Hub: the certificate list now sorts by title, last renewed or expiry across all pages, instead of only within the page shown
• Hub: Request Progress shows a progress bar on the stage that is running
• Managed ACME: ACME clients can look up their existing account by its key (including onlyReturnExisting), several orders can be processed at once, and errors follow RFC 8555 so clients can tell why a request was refused
• Certificate requests: names a CA adds to the order that you did not request, such as the www variant log warning in the request log. Enable the new Strict ACME Order Identifiers setting on the Advanced tab of the instance settings to leave them out

Fixes:

• Security: OIDC sign in now uses the authorization code flow with PKCE, validates the ID token issuer and reads the provider's endpoints from its discovery document. The unused Response Type and Response Mode provider settings are removed
• Security: tag changes made with an API token are now limited to the role assignments the token is scoped to
• Managed ACME: an order polled or finalized after it has been processed no longer gets stuck and then removed
• Managed ACME: a certificate download can now be retried, and orders are no longer removed while still being processed
• Managed ACME: certificates created for Managed ACME orders are shown read-only, are no longer listed as needing attention or waiting for you, and only the run that finishes the order is kept in request history
• Certificates: empty domain entries in a certificate saved through the API are now removed, so they no longer cause errors
• Certificate subscriptions: scheduled subscription updates now run as tracked requests, so their progress finishes and their outcome and deployment tasks are reported
• Hub: requesting a certificate on the hub's own instance now returns once the request has started, so it no longer times out behind a proxy
• Hub: changing the hub URL or joining an instance to the hub again now connects with the new details without restarting the instance service.
• Hub: a wrong password in the sign in again dialog keeps the dialog and the page under it, and users whose roles do not allow listing instances or tags can use the UI
• Hub: certificate editor fixes: choosing not to discard keeps a new certificate, a saved new certificate switches to editing, discarding reloads its tags, a failed delete is reported, and Discard, Duplicate and Delete only show for saved certificates
• Hub: the UI's stylesheets and scripts are now versioned by their content, so a browser no longer keeps an old version after an update

7.3.1 : 2026/10/16

Enhancements:

• Hub: new instance setting to restrict local changes on an instance to read only, or to deployment tasks only (instances must run 7.3.1 or higher)
• Hub: new Enforce Strict CNAME Delegation setting for managed challenges, enabled by default
• Hub: when your sign in ends, you are asked to sign in again over the open page, so unsaved changes are kept
• Hub: a failed save of a certificate, managed challenge, stored credential or instance setting now shows the reason
• Hub: a new certificate can now only be added on an instance your role permits and the hub can reach, and the hub explains why if there is none
• Security: API token secrets are now hidden until unlocked

Fixes:

• Managed challenges: delegated record names matching the managed challenge's own CNAME delegation rule are accepted again. Disable Enforce Strict CNAME Delegation to accept delegation rules set on instances
• Certificate requests: the CSR now always includes the requested domains, even if the CA changes its order
• Certificate requests: finalizing no longer fails with an unexpected error when the CA does not return the order
• Certificate requests: a certificate can no longer be saved while a certificate request for it is in progress, as the request would overwrite the changes when it finishes. The hub shows why the save was refused
• Certificate requests: on Linux and macOS, failing to write the certificate to the .NET certificate store is now a warning instead of a failed request, as nothing else uses that store. Certificate storage errors now include the underlying cause
• Managed challenges: DNS challenge configuration tests are no longer refused
• Hub: each instance's certificate list now stays current, including after the instance connects, imports certificates or switches data store
• Hub: listing certificates no longer fails while an instance is reporting changes
• Hub: saves no longer time out while an instance is busy with a long-running command such as a certificate request (instances must run 7.3.1 or higher)
• Hub: OIDC users with no email claim, such as Entra ID users without a mail attribute, now get their sign in name (preferred_username or UPN) as their username instead of an external ID. Existing users are corrected at their next sign in
• Hub: a changed username is now saved when editing a user, and a username already in use is refused. A failed or cancelled edit no longer changes the user list
• Hub: the UI keeps working through hub outages. Live updates reconnect once the hub is back, a sign in renewal that cannot reach the hub no longer signs you out, and an open certificate reloads if it changed meanwhile
• Hub: the certificate editor now enables Save for changes made after a save, and edit dialogs no longer lose input when the page redraws
• Hub: a page that fails again straight after recovering now shows the error with a Retry button
• Hub: the UI no longer fails to load after an update when the browser has the old version cached
• Hub: the instance actions menu no longer closes during a background refresh
• Docker: the hub image now has a writable home folder for any user in the root group, such as on OpenShift, so the .NET certificate store can be written

7.3.0 : 2026/10/07

Enhancements:

• Hub: new activity and request history, so you can see what has happened across your instances and why a request failed without checking each instance's logs. The Summary page shows items needing attention, the change since yesterday, instance connection history, upcoming renewals, renewal activity and a live activity feed. Request Progress shows each request's stages, its run log and any action waiting on a person, along with searchable history of finished requests. A new Activity page lists recent events, and you can configure how long activity is kept. Activity is reported by instances running 7.3.0 or later
• Hub: the instance browser is now generally used in place of a simple dropdown list to make instance browsing easier
• Hub: the certificate list now shows each certificate's CA, key type and issuer, with filters for CA and key type and a summary count of each. This makes it quick to find every certificate affected by a CA change, a CA distrust or a key type policy. Columns can also be hidden to keep the list focused
• Hub: new tag view scope for teams that divide responsibility by tag. Tags chosen in the app bar narrow every page to your area, and new certificates, managed challenges and stored credentials are tagged to match.
• Hub: certificates can now be revoked from the hub, so a compromised or unwanted certificate can be dealt with without signing in to the instance that manages it. Revoked certificates show a revoked banner, are reported with error health and appear under Needs Attention with a renew action.
• Hub: a certificate is now only flagged as expiring once its renewal is due, based on the certificate's lifetime. Short-lived certificates no longer raise constant warnings that hide the ones that actually need action
• Hub: a new setting lets the hub subscribe to the managed certificates it holds itself. One certificate can then have several subscriptions on the hub, each with its own deployment tasks, so the deployment of one certificate to different places can be split up instead of held in one long task list
• Hub: removing an instance from the hub now tells the instance (if connected) to forget its hub joining credentials. A removed instance no longer registers itself again, so removal is a single step. A warning is shown if the instance could not be told
• Hub: refreshed visual design and a reworked certificates summary that shows status at a glance.
• Domain match rules: new **.domain rule matching subdomains at any depth. A single rule can now cover a whole domain hierarchy instead of one rule per level
• Deployment tasks: the Export Certificate, Tomcat and Centralized Certificate Store (CCS) tasks can optionally set a new password, held as a stored credential, for exported PFX files and encrypted PEM private keys.
• Windows: a new optional setting chooses the private key storage provider (a legacy CSP or CNG) used when importing certificates into the Windows certificate store. Applications that only work with keys held by a specific provider can now use the certificates directly. It can be set in the desktop app or from the hub
• DNS: new EuroDNS (reseller) provider via Posh-ACME, for automated DNS validation of domains hosted there
• Security: adding or changing script and program settings is now limited to administrators, so lower-privileged users cannot introduce commands that run on your servers. This covers PowerShell and program deployment tasks, legacy request scripts and the custom script DNS provider. Existing settings that are saved unchanged are still allowed
• Security: tag scopes and domain restrictions are now applied per role assignment and consistently across certificates, certificate downloads, stored credentials, managed instances, managed challenges and live status updates. Users only see and act on the items their roles cover, wherever they access them

Fixes:

• Certificate cleanup: certificate files still in use by a managed certificate are no longer removed for being over a year old. This affected certificate subscriptions, which update the same file in place
• Certificate requests: reading a newly issued certificate no longer leaves an orphaned private key file behind on Windows
• Exchange deployment task: now always runs in a Windows PowerShell system process, as the Exchange snap-in requires. The "Do not require SSL" option is now applied, and the task stops at the first error
• DNS: Posh-ACME providers that need a separate save step now have their DNS record changes saved
• Challenge delegation: domain match rules can now match subdomains at any depth with **.domain.com
• Hub: notification email and CSR common name settings saved from the hub now persist on the instance
• Hub: standard roles and policies setup now completes even when the built-in admin account has been removed
• Hub: Managed ACME no longer loses the record of already used External Account Binding (EAB) keys when migrating from earlier file-based state
• Hub: the configuration test now waits longer for slower instances, shows progress and reports an error if the test request fails
• Hub: instances that drop their connection are now shown as disconnected. Previously they appeared connected until the hub restarted
• Hub: saving an item no longer shows an "updated elsewhere" notice for your own change
• Hub: the certificate subscription source picker no longer offers the item being edited, and hides subscription items by default
• Hub: Windows event log output now defaults to warnings and above, reducing log noise

7.2.0 : 2026/08/27

Enhancements:

• Hub: API authentication hardening, including rate limiting and request body size limits on authentication endpoints, and authentication now required in all cases where it was previously optional. Note: agent/ccm instances older than 7.0.18 will require an update to reconnect.
• Hub: managed certificates now report a calculated renewal plan and the hub shows the scheduled renewal information.
• Hub: managed certificate lists now show icons indicating the item type
• Hub: Managed ACME challenge access can now be restricted using security principal roles and tag-scoped permissions, with centralized domain matching and improved authorization checks for API clients
• Hub: assigned roles can optionally be restricted to specific domains (resource restrictions), applicable to certificate operations and Managed ACME requests
• Hub: filter the instances and certificates summary views by tag, with tag scoping also available when editing API token permissions and previewing role scope
• Hub: new data store connection administration and migration UI, with connection validation before saving, encryption of stored connection configuration.
• Hub: password login can now be disabled so that sign in is via OIDC only
• Tags: extend the range of supported tag values
• External certificate managers: improved config status reporting, log retrieval and an on-demand refresh option
• Data stores: New data store administration and migration for Postgres and SQL Server. With schema version checking and automatic migration on connection.
• DNS: new providers available via Posh-ACME: DNSExit, GoDaddy DNS API v3, Hosting.nl, Infomaniak DNS API v2, Microsoft DNS, mijn.host and Spaceship
• DNS: AWS Route 53 now supports cross-account access using AssumeRole (contributed by VA6DAH)

Fixes:

• Hub: the JWT signing secret is now provisioned automatically into hubservice.json on first start if one has not already been configured
• Manual DNS: paused orders correctly resume processing after the challenge has been completed
• Certificate cleanup: improve matching of certificate friendly names, including case-insensitive [Certify] markers and safer fallback names
• DNS providers: fix for following DMEasy insecure redirects
• Dashboard: fix persistence of dashboard registration state settings
• Hub: improvements and fixes for displaying and editing certificate subscriptions and externally managed certificates
• Package updates including BouncyCastle 2.7.0 and SSH.NET 2026.0.0

7.1.1 : 2026/07/09

• Fixes:
  • Core: important fix for failed renewals not being re-attempted due to deployment task success. All 7.x users are encouraged to upgrade.
  • PowerShell: errors raised in system powershell processes were not always flagged as a task failure, plus misc fixes and improvements
  • Windows: fix service path quoting for new installs

7.1.0 : 2026/07/01

General Release for 7.x

• Minor updates from previous release candidates.

7.0.22 : 2026-06-24

• Fix OIDC auth controller logging error

7.0.21 : 2026-06-24

• Enhancements:
  • Managed Instances: Added support for rejoin actions from both desktop and hub manager UI, including batch rejoin options.
  • Managed Instances: Added batch actions in manager for Dashboard assignment, Tags, and Remove from Hub.
  • Notifications: Added per-instance notification email preference support, used instead of ACME account email where configured.
  • Subscriptions: Advanced certificate options are now available for subscription-managed certificates in manager UI.
  • DNS: Added HostUp DNS provider support via Posh-ACME.
  • DNS: GoDaddy DNS now uses the Posh-ACME provider path, deprecating our legacy provider.
  • Scripts: Improved script execution providers, including updated Linux local script support and improved PowerShell result parameter handling.
  • UI: Various manager and desktop usability refinements (recent items formatting, cert details layout, and managed instance navigation improvements).
• Fixes:
  • Licensing/Activation: Activation and licensing checks now use stable ID rather than machine name to avoid issues after hostname changes.
  • Hub Connectivity: Improved error reporting when hub licensing checks cannot communicate with the API.
  • Subscriptions: Hub-sourced certificate subscriptions no longer poll unless renewal is due.
  • Managed Instances: Instances are now marked pending until initial connection is completed.
  • Validation: Internal hostname pre-validation has been removed so CA-side validation determines acceptance.
  • Deployment/Tasks: PowerShell in-process task execution now consistently supports optional result input parameter behavior.
  • UI/Status: "View Log" option is always available in certificate status, and binding update messages are no longer shown when no binding update occurred.
  • Updater: Fixed AutoUpdate script compatibility for 7.x.

7.0.20 : 2026-05-29

• Enhancements:
  • Core & UI: Updated our draft dns-persists-01 suppport
  • UI: Various minor layout and UI updates.
• Fixes:
  • Tasks: Manually resolving a failed task now updates the overall status and reports to dashboard etc.
  • Tasks: Tasks should not execute if the previous request was a success, only the current primary request should be considered unless running tasks manually.
  • Core: Update ARI replace skip logic
  • Managed Challenges: prefer hub joined instance authentication before any other provided credentials
  • Hub Service: Perform custom reload of hub service certificate config. Automatic reload provided by .NET was not reliable.

7.0.19 : 2026-05-22

• Enhancements:

  • PowerShell BREAKING CHANGE: PowerShell support has been significantly revised and compatibility may be affected. You are encouraged to test your workloads before deploying.

    • Previously 7.x versions used in-process PowerShell 7.x, which is not compatible with some existing PowerShell scripts/add-ins including our built-in example Exchange/RDP tasks. Versions before 7.x used an older version of .NET and In-Process PowerShell 5.1.
    • PowerShell scripts will now run in the default Automatic execution mode:
      • Windows: launches as a new process using the system PowerShell (5.1 by default where available).
      • Linux: runs PowerShell 7.x in-process
      • The Launch New Process option is retired in favour of the execution mode options.
      • Added experimental new Full Impersonation mode (Windows)
      • More information at https://docs.certifytheweb.com/docs/script-hooks

  • UI & Core:

    • Common Name is now re-enabled by default in generated CSRs despite being deprecated, so there is now a global setting for this behaviour.
    • There is a new option to ensure CA intermediates are added to the machine intermediates store (Windows). Most machines do this automatically except where outgoing http is blocked.
    • General settings have now been split into renewal-related settings and advanced settings.
    • Primary request status is now tracked independently of Task status for fine-grained error status tracking.
    • New option to duplicate an existing managed certificate for easier copying of complex items
    • Settings: Added new per-instance system log viewer
    • Fixed issue with target instance IDs appearing as GUIDs instead of the resolved target instance name.
    • Various UI refinements including Certificate Subcriptions, Managed Challenges etc.

  • Hub API: new public endpoints for listing managed instances and adding new managed certificates (using managed challenges by default).

• Fixes:

  • UI: Review of date/time format consistency in the UI.
  • Tasks:
    • Fix to allow a task to be manually run when the main request has failed, and also ensure tasks still run if they are set to run on primary request failure.
    • Fixed UI for the list of services in the service restart task (Windows).
  • Various dependency updates, minor fixes and refinements

7.0.18 : 2026-04-10

• Enhancements:
  • Core & UI: Implement support for Hub managed Certificate Subscriptions. This allows an authorized instance to subscribe to a hub managed certificate so that the hub can look after renewal and the managed instance just performs deployment.
  • Core: Draft support for the upcoming dns-persist-01 ACME Challenge type, which enabled persisent DNS validation with a single record per domain/subdomain.
  • Core: New support for filtered access determined by assiging Managed Instances tag scoped roles under Security. Support updated for tagged Managed Challenges to simplify access.
  • Core & UI: Dashboard reporting can now be administered via the hub for each managed instance.
  • Managed Challenges: Tag scoped access. New managed challenge polling mechanism also allows for long running managed challenge tasks.
  • UI: Custom CAs now allow overlapping DNS labels previously prevented by validation.
  • UI: Admin - review subscribable/accessible items each instance is allowed to see based on their assigned roles (optionally tag scoped).
  • UI: Managed instances can now be assigned custom titles
  • UI: Recently Viewed items in nav
  • UI: Various layout and content updates
  • DNS: Add Technitium provider via Posh-ACME
  • Hub API: Reorganize public and internal endpoints and split docs (Settings > Security > API Access) for easier reference.

7.0.17 : 2026-02-12

• Enhancements:
  • Initial 7.x Production Release
  • Tagging: Major new tagging feature to help organize, filter and manage resources. Includes new experimental tag scoping for service principal roles (context dependant).
  • Misc:
    • CA editor now allows you to flag CAs which require CN in the generated CSR.

7.0.16 : 2026-01-12

• Enhancements:
  • Core & UI: Deprecate support for Days After/Days Before renewal internal modes. Shorter certificate lifetimes now require percentage lifetime elapsed based renewal.
• Fixes:
  • UI: Maintenance window settings would previously error due to missing model properties if preferences had not been previously updated.

7.0.15 : 2026-01-09

• Enhancements:

  • Core: New Maintenance Window feature allows you to optionally set a named day/time window in the week for renewals to be attempted, this can be applied globally per instance or per managed certificate.
  • Core & Export: New optional strict export chain building options and best-efforts chain building.
  • UI: New Certificate Details view under Certificate > Advanced > Details, show the decoded certificate and export chain (strict chain or derived from machine trust store).
  • UI: Basic sorting of managed cert attributes in list view

• Fixes:

  • Hub: Periodic refresh of managed items per instance
  • Core: log when preferred chain not matched
  • CA: Some CAs require CN in the generated CSR

7.0.14 : 2025-11-21

• Fixes:
  • Core: IMPORTANT Fix issue with SQLite database filtering for auto renewed items. All 7.0.13 users must upgrade or renewals will not occur.
  • Hub: Fix issue with instance reconnection after hub restarts/updates failing due to expired authentication. This requires updating both the hub and any associated instances.

7.0.13 : 2025-11-17

• Enhancements:

  • Core: initial support for proxies via HTTPS_PROXY/HTTP_PROXY/CERTIFY_PROXY environment variables
  • UI:
    • Managed Instances view now shows connected/not connected instances and has extensive filtering UI
    • Managed certificates browse view has new instance browser for easier filtering
    • Managed certificate now open in a dialog to avoid navigation away from list view
    • Import/Export: comprehensive updates to UI and functionality.
    • General UI updates
  • DNS: New Hetzner Cloud provider via Posh-ACME
  • Installer: new option to skip service startup on first use, this allows the user to customize the service account before encrypting any credentials etc. Service is no longer recreated, so service account choice remains in place.

• Fixes:

  • Tasks: Apache/nginx files copy tasks updated for linux
  • Http Challenge: Allow serviceconfig to point back to API when using https, so that challenge responses can be retrieved.
  • Instances: improved sync of changed managed item info

7.0.12 : 2025-10-28

• Enhancements:
  • UI: Minor layout updates
• Fixes:
  • DNS: Fix AWS Route 53 provider error due to SDK changes.
  • Hub: Fix incorrect summary totals caused by duplicate cached instance info

7.0.11 : 2025-10-24

• Enhancements:
  • General: Move from beta to release candidate status for production use.
  • Managed Challenges: Add new (Use Managed Challenge) DNS authorization option for certificates managed directly on the hub, which require no additional config.
  • UI: disable add/edit options for users when in read only modes
  • Access: Add new managed challenge admin role
  • Minor dependency updates
• Fixes:
  • OIDC: fix authentication routing
  • CA: Google Trust Services currently require CN in the generated CSR
  • Core: Clean-up X509Certificate2 after use to avoid temp RSA keys remaining on disk.

7.0.10 : 2025-10-06

• Enhancements:
  • UI: Improve login form key events handling, remove reload on login
  • UI: Use .Net 10 for frontend
• Fixes:
  • OIDC: Fix editing OIDC provider config
  • UI: Fix date formatting in download log

7.0.9 : 2025-10-03

• Enhancements:
  • Auth: New OpenID Connect (OIDC) provider support, allowing users to sign in using common Single Sign On providers such as Azure Entra.
  • Tasks: Change task execution order
  • UI: Login submit on enter, darker Dark Mode theme for better contrast, nav menu is responsive based on screen size.
• Fixes:
  • Managed ACME Server: certificates are no longer created as Staging only.
  • DNS: Fix incorrect parameter for NameSilo provider
  • Access: Refresh system auth roles config regardless of version changes etc
  • UI: Managed certificate order should not change on refreshing cached details, Task edits should result in Save option enabling.
  • UI: Dates should be displayed in consistent format
  • UI: Fix UI path routing on refresh,

7.0.8 : 2025-09-18

• Enhancements:
  • Tasks: (Windows) Start/Stop/Restart A Service task renamed to just Restart a Service. Minimized service dropdown layout changes by limiting display name length.
  • Minor dependency updates

7.0.7 : 2025-09-15

• Fixes:
  • Managed ACME: Improve compatibility with ACME clients
  • Managed ACME & Managed Challenges: Auto clean-up of managed DNS challenges

7.0.6 : 2025-09-05

• Enhancements:
  • Managed Licenses: Managed multiple licenses within the hub and apply/remove them in batches to managed instances.
  • Core: Add PKIaaS.io as built-in CA option, deprecate BuyPass as a supported CA as they have discontinued their ACME service.
  • CLI: add version command and fixes for json output, add license check output
  • Auto Update: fix app name in auto update PowerShell script
• Fixes:
  • Data Stores: Arm64 SQLite database fixes
  • Improve compatibility of Managed ACME service for clients including acme.sh

7.0.5 : 2025-07-29

• Enhancements:
  • Hub UI and API:
    • Managed ACME: Experimental ACME proxy service, allowing any EAB enabled ACME client to use the hub ACME API and have DNS challenges be completed automatically by the hub using Managed Challenges (even if the original ACME client does not support DNS challenges).
    • UI: Improved handling of auth expiry in the UI, general UI updates (CA list and editor), additional validation UI for challenge configurations, Reset Status option
    • Stored Credentials: Implement optional unlockable stored credentials (allowing specific secrets to be read via API for custom scripts etc), add optional expiry date not so that expiring credentials are more visible.
    • Core: Add Actalis as a built-in CA configuration
    • Core: Cert CN (deprecated by CAs) is no longer set in CSR unless the configuration specifically requires it.

7.0.4 : 2025-07-03

• Enhancements:
  • API & UI: Additional updates for restricting actions based on roles
  • UI: assorted updates and improvements
  • Security: Add hub viewer role for real only hub access (dashboard readers etc)
  • Updated support for monitoring certs managed by external cert managers on same instance or on ccm/agent instances (including new config options under Settings):
    • Certbot
    • acme.sh
    • win-acme & simple-acme
    • Posh-ACME

7.0.3 : 2025-06-12

• Enhancements:
  • Core:
    • DNS: Add NameSilo DNS provider
    • Dashboard: Remove status reports if item deleted
    • Updated dependencies

7.0.2 : 2025-05-21

• Fixes:
  • UI: periodic cleanup of progress and test results
  • UI: auto sign out when API auth expires
  • UI: fix domain list entry for cert identifiers
  • Minor updates and fixes
• Enhancements:
  • UI updates including CA account EAB settings and custom key options

7.0.1 : 2025-05-05

• Enhancements:
  • Hub service now includes default hubservice.json config for configuration of https and preferred host:port
• Fixes:
  • /docs/api shows available API
  • Log plugin errors on service load
  • Implement Certificate > Security options (Custom CSR, Custom Key, PFX password etc)

7.0.0 : 2025-04-29

• Introducing Certify Management Hub (alpha)

---