Deprecated functionality from Palo Alto Networks Trust Protection Foundation

Summary

This article contains a current list of features that have been removed from shipping versions of Palo Alto Networks Trust Protection Foundation (formerly known as Venafi Trust Protection Platform, and more recently as CyberArk Certificate Manager - Self-Hosted). Deprecated features are grouped by the release in which they were removed. This document lists deprecations for all supported versions of Trust Protection Foundation, since you might be upgrading from any supported version, and you need to review the deprecated features for ALL versions between your source version and your target version.

Applies To

All versions of Trust Protection Foundation.

Trust Protection Foundation 26.2

VikingCloud (Trustwave) CA - Starting in 26.2, the VikingCloud (Trustwave) CA driver is removed from the product. VikingCloud revoked all of its certificates in February 2026 and exited the certificate business, with its portfolio acquired by SSL.com, so the legacy issuance API no longer works and certificates issued through this driver are already untrusted. Existing VikingCloud CA templates are converted to an Out of Band CA on upgrade and are no longer used for certificate issuance or renewal. No other action is required at upgrade: any workflow using this CA stopped working when the certificates were revoked. If you have not already replaced those certificates, move the affected policies to a supported CA.

QuoVadis CA - Starting in 26.2, the QuoVadis CA driver is removed from the product. Existing QuoVadis CA templates are converted to an Out of Band CA on upgrade and are no longer used for certificate issuance or renewal. Move the affected policies to a supported CA, such as the DigiCert CA driver.

Composite certificate specification version 12 - Starting in 26.2, the version 12 composite certificate format used by earlier releases is no longer supported. Trust Protection Foundation moves to version 19 of the specification, and a migration during the upgrade permanently deletes all composite certificate materials created before 26.2, including their private keys, CSRs, certificates, and vault IDs. There is no automatic conversion between the two formats. Before you upgrade, export or back up any pre-26.2 composite certificates you need to retain, then re-issue them under the 26.2 specification after upgrading.

ACME v1 protocol - Starting in 26.2, the ACME Server no longer supports ACME v1. ACME v1 is an old draft version of the ACME protocol. The ACME Server now supports only ACME v2 (RFC 8555), which all current ACME clients use, such as certbot and win-acme. After you upgrade, ACME clients that use the ACME v1 endpoints (/vacme/v1/) can’t request or renew certificates. Before you upgrade, check your ACME clients. If a client uses ACME v1, update it or set it up to use the ACME v2 directory URL.

Trust Protection Foundation 26.1

FTP Report Delivery - Starting in 26.1, FTP is no longer available as a delivery method for legacy reports or custom reports. This change addresses security concerns, as FTP transmits credentials in cleartext over the network. Reports previously configured for FTP delivery must be reconfigured to use Windows Share or SFTP (SSH File Transfer Protocol) instead.

Entrust Certificate Services and Public CA Changes - Starting in 26.1, Entrust Certificate Services are no longer supported as a standalone certificate authority (CA). All public certificate issuance and revocation functionality for Entrust has been migrated to Sectigo Certificate Manager (SCM).

RSA Certificate Manager CA - As of 26.1, RSA Certificate Manager is deprecated. Existing RSA certificate authority (CA) entries are migrated to an Out-of-Band CA and are no longer used for certificate issuance or renewal.

Trust Protection Platform 25.3

BlueCoat SSL VA Application Provisioning Driver – The BlueCoat SSL VA Application Provisioning Driver has been deprecated and is no longer supported in Venafi Platform 25.3 and later. If you are currently using BlueCoat drivers, you will need to transition to a supported integration before upgrading. Upgrading to 25.3 will convert them to “Basic” type. For information on supported application drivers and migration options, see Supported Application Drivers.

Trust Protection Platform 25.1

Windows Server 2012 Support for Venafi Platform servers - Windows Server 2012 is no longer supported for Venafi Platform servers. To upgrade to 25.1 you will need to use servers that have a supported version of Windows Server installed. See System Requirements for supported servers.

DSA Algorithm - You can no longer generate new SSH keys using the DSA algorithm. Existing keys can still be managed, but if you want to rotate keys, rotate to a more secure key algorithm.

Venafi Platform 24.3

Cloud Instance Monitoring - Introduced many years ago, this feature never got the traction we were hoping for. It was the ability that if you populated your device objects with your AWS EC2 Instance ID and gave TPP API access to your AWS Account, we would monitor EC2 instances for shut down and automatically revoke certificates and clean-up inventory. This capability has been removed in favor of features like Recycle Bin available now that can automatically delete devices and certificates from your policy tree based on the expiration of certificates.

SQL Server 2012 Deprecation - Venafi Trust Protection Platform is no longer be supported on SQL Server 2012. Prior to upgrading to version 24.3, you must upgrade to a higher version of SQL Server, preferably SQL Server 2019 or 2022. In addition, you must set the compatibility level of your database to support a higher version of SQL Server, preferably matching the server’s version.

Venafi Platform 24.1

WebSDK Authorization Method involving API Keys (End-of-Support) - The WebSDK authorization method that involves API keys was formally deprecated in Trust Protection Platform 20.2 and will no longer be available in code beginning in 21.3. The “WebSDk” permission that is available on users and groups will no longer be available. The temporary license key introduced in 21.2 will no longer be available.