PGP Universal(TM) Server Version 3.1 Release Notes

Transcription

1 PGP Universal(TM) Server Version 3.1 Release Notes Thank you for using this PGP Corporation product. These Release Notes contain important information regarding this release of PGP Universal Server. PGP Corporation strongly recommends you read this entire document. PGP Corporation welcomes your comments and suggestions. Please use the information provided in Getting Assistance to contact us. Product: PGP Universal Server Version: Warning: Export of this software may be restricted by the U.S. government. Note: To view the most recent version of this document, please go to the Documentation section on the PGP Support Portal. About PGP Universal Server PGP Universal Server provides your enterprise with secure messaging: it transparently protects your messages without user interaction. It automatically creates and maintains a Self-Managing Security Architecture (SMSA) by monitoring authenticated users and their traffic. You can also send protected messages to addresses that are not part of the SMSA. The PGP Universal Server encrypts, decrypts, signs, and verifies messages, providing strong security through policies you control. PGP Universal Satellite provides security for messages all the way to the computer of the user, it allows external users to become part of the SMSA, and it gives end users the option to create and manage their keys on their own computer. Note to PGP Universal Server Technology Partner Edition users If you purchased PGP Universal Server Technology Partner Edition, many features described in the documentation are not available. If you want to upgrade to the full version of PGP Universal Server, please visit the PGP Web Site. To determine if you have this version, navigate to the System/System Settings screen. If you have this version, your license information includes the words PGP Universal Server Technology Partner Edition. Common Criteria Environments To be Common Criteria compliant, please refer to the best practices shown in PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best practices supersede recommendations made elsewhere in this and other documentation. What's Included in This File About PGP Universal Server Changes in This Release System Requirements Upgrade/Migration Requirements Additional Information Getting Assistance Copyright and Trademarks Changes in This Release This section lists the changes and new features in PGP Universal Server Software Development Kit in this release. Upgrade/Migration Issues

2 Warning: If you are upgrading from an earlier release of PGP Universal Server, there are several circumstances that may require some actions on your system prior to beginning the migration process, in order to avoid problems after the migration. If you are using a hardware token ignition key or a Hardware Security Module (HSM) with any software version prior to 3.1 including a migration (backup/upgrade/restore) from or If you are migrating a 2.x cluster to version Please see the warnings in Upgrade/Migration Requirements or refer to the information in the PGP Universal Server Upgrade Guide before you begin the upgrade or migration process. Contact PGP Technical Support if you have questions. What's New in PGP Universal Server Resolved an issue in client connection management that could result in the incorrect association of clients, devices, and keys. [27758] What's New in PGP Universal Server 3.1 The 3.1 release of PGP Universal Server introduces the following new and improved features: PGP Remote Disable & Destroy with Intel Anti-Theft Technology addresses the need to keep data secure in mobile environments, and comply with increasingly stringent regulations in data security and privacy. With PGP RDD, you can remotely disable computers, and/or disable access to data if the computer is lost or stolen, and perform secure decommission of computers. The methods for installing, verifying, and configuring PGP Universal Server and PGP Desktop licenses has changed as of version 3.1. The PGP Universal Server license is now verified internally without requiring a network connection to a PGP license server. As a result, the configuration of a proxy server to access the licensing server is no longer needed, and has been removed. If you have a license for PGP Universal Gateway there is now a check box you must select to enable mail proxying. You can do this when you enter your license during the Setup Assistant, or from the administrative interface. PGP Desktop licenses are now pre-installed. It is no longer necessary to enter a license in a Consumer Policy. However, by default, all separately-licensed features are disabled. If you purchase a PGP Desktop license with optional features such as PGP Whole Disk Encryption or PGP NetShare you must enable those features prior to creating your PGP Desktop installer. Automatic updates are no longer supported within the PGP Universal Server. Instead, when an update is made available you will be able to download it to a local system, upload it to your PGP Universal Server and install it. As a result, the ability to check for updates, either manually or automatically from the administrative interface has been removed. Certain new features in the PGP Desktop version 10.1 client require the addition of preferences in the Consumer Policy options. For information on the features that require additional preferences, and for instructions on how to add these preferences, see Knowledge Base Article System Requirements PGP Universal Server is a customized Linux OS installation; it cannot be installed on a Windows server. Every PGP Universal Server requires a dedicated system that meets the system requirements listed below. The installation process deletes all data on the system and reconfigures it as a PGP Universal Server. PGP Universal Server Certified Hardware List - Valid 09/29/10 through 09/29/11 Please obtain the latest copy of this list for hardware purchasing decisions after 09/29/10. The following systems are certified for use as the hardware for PGP Universal Server: 1. Dell PowerEdge R610 - Two Quad-Core Intel XEON 2GHz - 4 GB RAM Two 146 GB 10K 2.5" SAS HD - SAS 6/iR RAID Broadcom BCM5709 network controller Small/medium environment production unit

3 2. Dell PowerEdge R710 - Two Quad Core Intel XEON 2.4GHz - 8 GB RAM Two 146 GB 15K SAS HD - SAS 6/iR RAID Broadcom BCM5709 network controller Medium/large environment production unit, cluster member 3. IBM System x3250 M2 - Quad-Core Intel XEON 3.16 GHz - 5 GB RAM Two x 150 GB SAS - LSI Logic SAS1064E ir RAID Broadcom BCM5722 network controller Medium/large environment production unit, cluster member 4. IBM System x3650 M2 - Two Intel XEON 2.4 GHz - 10 GB RAM Two 146 GB SAS 10K RPM - LSI Logic 1068E ir RAID Broadcom BCM5709 network controller Medium/large environment production unit, cluster member 5. IBM System x3650 M2 - Two Quad Core Intel XEON 2.4 GHz - 10 GB RAM Two 300 GB SAS 10K RPM - IBM ServRAID-MR 10i disk controller Broadcom BCM5709 Gigabit Ethernet Medium/large environment production unit, cluster member 6. IBM BladeCenter HS22 - Two Intel XEON 2.4 GHz - 8 GB RAM Two 146 GB SAS 10K RPM - LSI Logic 1068E ir RAID Broadcom BCM5709S network controller Small/medium environment production unit 7. HP Proliant DL120 G5 - Intel XEON X GHz - 2 GB RAM Two 250 GB SATA Broadcom BCM5722 network controller Small/medium environment production unit 8. HP ProLiant DL380 G6- Intel XEON 2.4 GHz - 6 GB RAM Two 146 GB SAS 10K RPM - Smart Array P410i RAID Broadcom BCM5709 network controller Medium/large environment production unit, cluster member 9. VMWare ESX 3.5.0, 4.0, ESXi Supported platform, non-hardware. Sufficient processing power equivalent to a 3 GHz Intel Xeon must be dedicated to the PGP Universal Server VM. VMWare tools must be installed and configured inside the PGP Universal Server operating system. VMWare ESX 4.0 is certified without VMotion. Disk space requirements: Small/medium environment - 50 GB minimum allocated to the VMWare instance; 4 GB RAM dedicated to the VMWare instance. Medium/large environment GB minimum allocated to the VMWare instance; 8 GB RAM dedicated to the VMWare instance. While a broad array of other hardware may work well with PGP Universal Server, incompatibilities related to hardware that is not one of the above systems will not be supported. To qualify as PGP Universal Server Certified Hardware, the server must be one of the models listed and all components must be configured as specified. Changing the sizes of hard disks within the same type of drive (for example, 36 GB SCSI to 73 GB SCSI), increasing memory configurations, and increasing processor speeds within the same type and family qualifies as the same system for Support purposes. Supported Client and PGP Universal Server Version Combinations PGP Corporation supports backward compatibility for clients only. For example, PGP Universal Server 2.0 is not supported for use with PGP Desktop 9.9. PGP Universal Server supports managing policy of these versions (and subsequent maintenance releases of each) of PGP Desktop:

4 Note: For the most current information on which client versions are supported, see the Knowledge Base. Note: There are certain features of PGP Desktop version 10.1 that may require the addition of preference settings in PGP Universal Server to change the default behavior or to enable new features. For information on the features that require additional preferences, and for instructions on how to add these preferences, see Knowledge Base Article PGP Universal Server supports managing policy of these versions (and subsequent maintenance releases of each) of PGP Universal Satellite: Note: Policy options for features that are non-existent in supported legacy versions are ignored by those installations. PGP Universal Server provides limited management support (without policy) back to PGP Desktop version 9.0 and PGP Universal Satellite version 2.0. Mailserver Requirements PGP Universal Server is compatible with many mailservers. However, it is tested and supported on the most common mailservers. Mailservers not on this list may not be fully compatible or supported: Microsoft Exchange Server 2007 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2000 SP3 Lotus Domino Server Lotus Domino Server 6.5 Lotus Domino Server Stalker Communigate Note that in addition to Microsoft Exchange Server 5.5 not being a supported mailserver, it has known incompatibilities, including an incompatibility with the LDAP Directory Synchronization feature. Additionally, limited testing is performed with the following open-source mailservers: postfix 2.X sendmail 8.X

5 uw-imapd 2002 and 2004 popa3d qpopper 4.0.X exim 3.36 and 4.X Cyrus PGP Corporation Compatibility Status with Microsoft Exchange Server 2007 PGP Corporation is pleased to announce compatibility with Microsoft's new Exchange Server PGP Desktop 9.6 introduced support for Microsoft Exchange Server 2007 and Microsoft Office When used with Internet-standard PGP/MIME (RFC 3156) messages, full message fidelity is preserved for all secured messages. With Exchange Server 2007, Microsoft has introduced a change in functionality that converts all messages to its internal MAPI format immediately upon processing, unlike previous versions of Exchange that supported the MIME standard for . Exchange Server 2007, when both sending and receiving via non-mapi clients, destroys MIME structures in . However, PGP/MIMEencoded messages are fully compatible with this Microsoft transition even when MAPI is not in use. All messages sent between PGP Corporation's MAPI clients are also fully compatible. Please note that messages encoded using the legacy "PGP Partitioned" format may not always display HTML message content properly, and foreign character sets in such messages may not reproduce correctly when processed through Exchange Server If such messages are processed from non-mapi clients, the server may delete some encrypted HTML body parts and remove non-ascii character set information, thus resulting in messages that do not preserve full fidelity. If your organization currently uses the legacy PGP Partitioned encoding with non-mapi clients, PGP Corporation recommends not upgrading to Exchange Server 2007 at this time. PGP Corporation is working with Microsoft to seek additional solutions for compatibility between Exchange Server and the MIME standard. PGP Corporation will update the Support Knowledge Base Article #713 as more information becomes available. PGP Universal Server Administrative Interface Web Browser Requirements Windows Mac OS X Internet Explorer 6 and greater Firefox 1.0 and greater Safari 1.0 and greater Firefox 1.0 and greater PGP Universal Web Messenger Web Browser Requirements The PGP Universal Server administrative interface has been fully tested with the following Web browsers: Windows 2000 Professional and Advanced Server: Mozilla Firefox 3.0, Internet Explorer 6.0, Internet Explorer 7.0 Windows XP Professional and Pro x64: Mozilla Firefox 3.0, Internet Explorer 6.0, Internet Explorer 7.0 Windows Vista: Mozilla Firefox 3.0, Internet Explorer 7.0 Mac OS X 10.4: Mozilla Firefox 3.0, Safari 2.0 Mac OS X 10.5: Mozilla Firefox 3.0, Safari 3.1 While you might find that the administrative interface works with other Web browsers, we recommend these browsers for maximum compatibility. PGP Universal Satellite for Windows Requirements Note: In order to continue to improve our products, we have added support of the Microsoft Windows 7 operating systems in PGP Universal Satellite 3.0. As a result, we are ending PGP Universal Satellite support for Microsoft Windows 2000 Professional and Microsoft Windows 2000 Server & Advanced Server beginning with PGP Universal Satellite 3.1. Before you begin the installation, verify that your system meets these minimum requirements: Windows 7, Windows Vista (32- and 64-bit editions), Windows XP (Service Pack 2 or 3), Windows Server 2003 (Service

6 Pack 1) Note: The above operating systems are supported only when all of the latest hot fixes and security patches from Microsoft have been applied. 512 MB of RAM 64 MB hard disk space Internet Explorer 6 or greater PGP Universal Satellite for Mac OS X Requirements Mac OS X 10.5.x or 10.6.x (Intel or PowerPC) 512 MB of RAM 64 MB hard disk space 10.4.x removed, 10.6.x added. Nov. 2, 2009 Supported External Authentication Products PGP Universal Server is compatible with the following LDAP directory products: Microsoft Active Directory 2008 Microsoft Active Directory 2003 Microsoft Active Directory 2000 Lotus Notes/Domino Directory 7.0 OpenLDAP 2.3.x Lotus Notes/Domino Directory 6.5 For directory synchronization, PGP Universal Server supports: LDAPv2 LDAPv3 LDAPS For PGP Universal Web Messenger external authentication, PGP Universal Server supports: LDAPv2 LDAPv3 RSA Radius Server with RSA Authentication Manager 7.1 Anti-Virus Software Compatibility For information about antivirus compatibility, see the PGP Desktop for Windows Release Notes or the PGP Desktop for Mac OS X Release Notes. Upgrade/Migration Requirements There are two methods available for upgrading a PGP Universal Server: The migration process, where you back up data to an external location, install the new software version from CD or DVD, and then restore your data. Follow the instructions in the PGP Universal Server Installation Guide to perform an installation from DVD. The PUP update process, where you download and install a PGP Update Package (PUP)format file from within the administrative interface of your PGP Universal Server. This method automatically preserves your data and system settings. For instructions on performing a PUP update, see the PGP Universal Server Administrator's Guide. Note: Not all upgrades are available as PUP update files. Some upgrades may require a full migration where you to back up your system, perform a new installation of the software, and restore your backup. The upgrade to version

7 3.1.0 from versions prior to 3.0 is an example. Warning: If you have a hardware token Ignition Key or a Hardware Security Module (HSM), you must contact PGP Technical Support before migrating to PGP Universal Server Migration to version requires the creation of a new setting on the upgraded (3.1.0) version of PGP Universal Server before you restore the backup from your previous system. This setting can only be added through SSH access, with the help of PGP Technical Support. If you migrate to version without adding this preference, you will be locked out of the user interface after upgrade and you will not be able to use your hardware token Ignition Key to unlock your PGP Universal Server. This can also occur if you upgrade from to using a PUP update. If you are using a hardware ignition key, you must edit the settings in your installation BEFORE you do the update. You do not need to change any settings if you are running PGP Universal Server version Important: In order to successfully migrate your data from PGP Universal Server 2.x to PGP Universal Server version 3.1.0, you should plan to have disk space available equal to 10 times the size of the backup file (the backup file will be significantly smaller that the size of the original 2.x database). For example, if your version 2.x backup file is 1 GB in size, you should have 10 GB of disk space available to allow for the migration and re-expansion of your data into the 3.1 database. Warning: There are special requirements for upgrading a cluster running version 2.x software. For instructions on migrating a cluster, see Migrating a Cluster in thepgp Universal Server Upgrade Guide. The following applies to PGP Universal Servers that you will run as stand-alone systems. The upgrade to PGP Universal Server version from a version prior to version requires a migration: you must back up your current system, install the upgrade from DVD, and then restore your data. You can migrate to PGP Universal Server from version or later. If you are running a version prior to 2.7.0, you must first upgrade to If you are running PGP Universal Server version or later, you can use the PUP update process to update to version Important: Before you upgrade to PGP Universal Server 3.1.0, you must back up your data and your organization key to an external location. You will need your organization key to restore your backed-up data. You can migrate directly to PGP Universal Server version from any of the following previous versions: R Note: On PGP Universal Server 3.1.0, you can only restore backed-up data from version and later. To upgrade from version or 2.6.x you must first migrate to version To upgrade from a version prior to 2.5.3, you must first upgrade to and then upgrade to Upgrade Steps The following sections describe the steps required to perform an upgrade from a previous version of PGP Universal Server for a

8 single server. To migrate a cluster, please follow the instructions in the PGP Universal Server Upgrade Guide. Note: As part of restoring a backup onto the system, data from the earlier version must be migrated to the new database. Once the migration completes, the system may remain busy for a time due to database activity. This is a normal part of the upgrade process. To migrate from a version of PGP Universal Server prior to 2.5.3: 1. Log in to your PGP Universal Server administrative interface. 2. Back up your version 2.0.x system data to an external location. (See the PGP Universal Server Administrator's Guide for your software version for installation, backup and restore instructions and best practices.) 3. Migrate to version using the CD. Restore your backed-up data. 4. Back up your version data to an external location. 5. Migrate to version using the CD. Restore your backed-up data. 6. Go to 7. One at a time, download and install PUP updates for versions 2.5.1, 2.5.2, and Note: You do not need to back up and restore data when upgrading using a PUP file. However, it is always a good idea to have a current backup when performing maintenance tasks on PGP Universal Server. Note: When installing multiple PUP updates, download and install them one at a time. If you download multiple PUP updates before you begin installing them, only the first installation succeeds. 8. Back up your version data and organization key to an external location. 9. Migrate to version and restore your backed up data. 10. Back up your version data to an external location. 11. Upgrade to version using the DVD, following the instructions in the PGP Universal Server Installation Guide. 12. Restore your backed-up data. To migrate from PGP Universal Server or 2.6.x: 1. Log in to your PGP Universal Server administrative interface. 2. Back up your data and organization key to an external location. 3. Migrate to version and restore your backed up data. 4. Back up your version data to an external location. 5. Upgrade to version using the DVD, following the instructions in the PGP Universal Server Installation Guide. 6. Restore your backed-up data. To migrate from PGP Universal Server or later 1. Log in to your PGP Universal Server administrative interface. 2. Back up your data and organization key to an external location. 3. Upgrade to version using the DVD, following the instructions in the PGP Universal Server Installation Guide. 4. Restore your backed-up data. To upgrade from PGP Universal Server 3.0 or later 1. Backup up your version 3.0 data and organization key to an external location. (This is not required for the update, but is strongly recommended). 2. Go to 3. Download the PUP update for version and copy it to the computer running PGP Universal Server version 3.0.

9 Note: You must have a valid maintenance agreement with PGP Corporation to access PUP updates. For more information, see 4. Log in to the PGP Universal Server administrative interface. 5. Select the System tab, and then click Updates. 6. Click Upload Update Packages to upload the update package from your hard drive. The Upload Update dialog box appears. 7. Browse to find the file you want, then click Upload. The update package appears on the list. 8. Click the icon in the Install column to install the update. The text in the Date of Last Action column says Currently Installing while the install is in progress. Note: You do not need to back up and restore data when upgrading using a PUP file. However, it is always a good idea to have a current backup when performing maintenance tasks on PGP Universal Server. Upgrade Best Practices As a best practice, PGP Corporation recommends that you test your upgrade in a lab environment before changing your production environment: Perform a fresh install on a test system in a lab environment, or upgrade/migrate an existing lab system running a previous version of PGP Universal Server. Test the lab system to ensure that your mail policies and other basic functionality of your server work as you expect. Migrate your live environment. See the PGP Universal Server Upgrade Guide for upgrade/migration information. Additional Information Please see the PGP Universal Satellite Release Notes installed with PGP Universal Satellite for additional information about that product. Note: Beginning with PGP Universal Satellite version 3.1, Microsoft Windows 2000 Professional and Microsoft Windows 2000 Server & Advanced Server are no longer supported. Installation and Upgrade Warning: If you have a hardware token Ignition Key or a Hardware Security Module (HSM), you must contact PGP Technical Support before migrating to PGP Universal Server Migration to version requires the creation of a new setting on the upgraded (3.1.0) version of PGP Universal Server before you restore the backup from your previous system. This setting can only be added through SSH access, with the help of PGP Technical Support. If you migrate to version without adding this preference, you will be locked out of the user interface after upgrade and you will not be able to use your hardware token Ignition Key to unlock your PGP Universal Server. [27062] When joining a node to a cluster, if the sponsoring server happens to be busy (for example, while the nightly key maintenance process is running) it may take a very long time (many hours) for the join process to complete. If it is not possible to perform the join at another time, you will need to stop crond and possibly shut down the key maintenance process before beginning the join. Please consult PGP Technical Support for help. [27841] Upgrading to PGP Universal Server 3.0 removes LDAP query customization. When you upgrade to PGP Universal Server 3.0 and later, customized LDAP queries must be recreated as necessary. With the enhancements to LDAP support in PGP Universal Server 3.0, LDAP query customization may no longer be needed. [27366] After upgrading a server with multiple NICs to PGP Universal 3.0, the NICs may be renamed. [24178]

10 When you reinstall PGP Universal Server 2.7 or later with custom partitions onto a computer that already has custom partitions, the installation fails. Workaround: reinstall without partitions, and then reinstall a third time with custom partitions. [26748] If you back up data from the Primary in a cluster, and restore the data to a new PGP Universal Server 3.0 installation, you cannot delete old cluster members unless the cluster member has a DNS-resolvable name. [26128] Sometimes, when you add a new member to a cluster, the sponsoring cluster member fails to immediately contact the new joining cluster member. Check the joining cluster member to see if it is waiting for contact from the sponsor. If it is, click the Contact button to try again. [25751] Before upgrading to PGP Universal Server 3.0 or later, make sure you do not have internal and external user policies with the same name. After migration, users will not receive the correct consumer policy. [23885] Restoring a backup of to a PGP Universal Server with a different IP address than the one stored in the backup does not change the IP address of the PGP Universal Server. [19918] When you back up data on one PGP Universal Server and then restore the data onto a different PGP Universal Server, MAC address information is incorrect. The MAC address on the restored PGP Universal Server is set to the MAC address of the backed-up PGP Universal Server. This cannot be fixed through the user interface. Contact PGP Support to correct the MAC address. [19895] After PUP updates, the screen is formatted incorrectly. Workaround: clear the cache or refresh the browser screen. [18011] Do not use international characters when specifying file names for backup files. [10834] A SSH key created and saved as a file using the PuTTY utility (PuTTYgen) cannot be imported as an Administrator key using the Key File import function (accessed from the administrative interface by going to the System > Administrators tab, clicking the administrator name, then selecting the plus icon to add an SSHv2 key). Instead, you must copy the key block from the PuTTY Key Generator and paste it into the Key Block field. [27325] If the database on the sponsoring server in a cluster has a very large database, the join of a cluster member may take a very long time. To avoid a join failure it may be necessary to increase the join timeout value setting prior to initiating the join. This setting can only be modified through SSH access, with the help of PGP Technical Support. [27763] Deployment If you enable PGP Universal Server to control the Notifier settings for managed PGP Desktop clients, the server-specified settings take effect as soon as policy is downloaded to the client. However, the Notifier button on the client will continue to be present until the user restarts the desktop client. [27100] With a large database, attempting to export a very large data set may take a very long time. Specifically, attempting to export very large sets of PDF Messenger Certified Delivery Receipts or exporting all WDE Activity may take a long time and generate an exception in the Administrative logs. In these situations it may be necessary to use the command line interface to execute a query against the database. For more details, go to the PGP Support Portal and view Knowledge Base Article [27033, 27076] When PGP Universal Server runs in Learn Mode, it annotates inbound messages, even if the inbound mail policy chain disables notation. After you turn off Learn Mode, mail policy applies and inbound messages are annotated correctly, according to policy. [26870] When you restart PGP Universal Server 3.0 and later, you may see the following warning: No dynamic config support. The warning is normal and does not indicate a problem. [26795] Key lookups that originate from sending may result in PGP Universal Server doing additional lookups for internal users when those internal users have a PGP Desktop policy with messaging disabled. [26327] If a PGP Desktop user is moved from the excluded user group to an internal user group, the user may not download policy for the new group, and may continue to use the policy previously downloaded for the excluded user group. To ensure that the user properly downloads and follows policy, make any update to the policy for the new group. [26263] When you login in to a new cluster member while the member is in the joining process, some data may not display properly when you navigate through the interface. This happens because data is being replicated and the new cluster member configuration is changing. Log off and wait until the cluster join is complete. [26057] HTTP-based services do not support port numbers higher than [25784] If you configure multiple LDAP servers, and the first is unavailable, PGP Universal Server does not continue to search for users in the other listed servers. [25587] PGP Universal Server does not provide out-of-the-box support for LDAP synchronization in environments where multiple LDAP servers contain identical samaccountname values for different users. If your environment contains multiple LDAP domains with some users having identical samaccountname values, please contact PGP Support for guidance on how to deploy PGP Universal Server into your environment. [25299]

11 When you create a client installer, if the domain for the PGP Universal Server specified in the Download Clients dialog box does not match a managed domain, silent enrollment does not work. [25046] When you install a new client with a new consumer group policy on an existing client computer, and LDAP enrollment is not enabled, the user is not moved to the new consumer group associated with that policy and does not receive the new policy. Workaround: Manually move the user to the correct consumer group. [24898] If you add PGP Universal Server to its own keyserver list at Keys > Keyservers, you must add it using the IP address. If you add it using the PGP Universal Server hostname, key lookups on that keyserver fail. [24698] When you set a group to match disabled users in Active Directory, PGP Universal Server matches all disabled users in the directory, ignoring any specified LDAP attribute/value pairs for that group. [23827] When you enable the setting to encrypt client sent folder contents, the prepopulated list of IMAP sent folder names is empty. Add the following sent folder names to PGP Universal Server to be matched: SENT SENT * GESENDETE GESENDETE *????????????* ELEMENTOS ENVIADOS ENVIADOS ÉLÉMENTS ENVOYÉS ENVOYÉ [23783] If communication between PGP Universal Server and your HSM is interrupted, you must re-start PGP Universal Server once communication has been re-established. [23739] To create a mail policy rule for expanding the To list for messages to mailing lists, make sure the conditions are in the correct order, or the rule is not applied. The correct order for the conditions must be: 1. Recipient domain <is/contains/matches>. 2. 'Recipient address is mailing list' 3. 'Mailing list user count is' <greater than/fewer than> [23723] PGP Universal Server 3.1 does not support SSL v1.0 certificates. [25378] With Microsoft Internet Explorer 8, security can be set to a HIGH state, which disables Javascript on most web pages. With Javascript disabled, PGP Universal Server's management console (administrative interface) and PGP Universal Web Messenger login will not function. Make security exceptions for PGP Universal Server in IE 8's security settings, or use a different browser to access the administrative interface. [23688] When clients with embedded consumer policy enroll it will, if required by policy, attempt to send key reconstruction data to the PGP Universal Server and fail. [23579] Silent Enrollment is only fully supported with Server Key Mode. During enrollment with other key modes, the user is prompted to enter a username and passphrase. [22709] When a NIC is set to a custom link mode, rather than auto-negotiate, the network driver no longer advertises other link speeds. PGP Universal Server requires access to the list of possible link speeds to populate the Network Settings Link Speed menu. If you want to change the Link Speed from a custom setting, and no other custom settings appear, select Auto from the menu. Restart PGP Universal Server. After restart, the Link Speed menu is populated with all available options for the NIC. [19287] MAC ID, MTU, and Link Speed are not applicable to PGP Universal Server hosted on VMWare because the ESX server controls the network settings. However, when you create a new virtual interface, those settings are automatically populated. If your PGP Universal Server runs on VMWare and you want to create a new interface or edit an existing interface, you cannot save your changes until you clear the auto-populated MTU, MAC ID, and Link Speed settings. [19810] Organization Keys with Japanese passphrases cannot be imported. [18620] The Silent Enrollment option does not work with existing certificates or keys, including CAPI and token keys. [16044] You cannot use spaces in the name of the backup FTP server. [15491]

12 Recovery from a Windows PE environment requires the use of a Whole Disk Recovery Token. TPM and hardware token users cannot be authenticated from within Windows PE. [15101] To replace an installation of PGP Desktop with embedded policy with an installation of PGP Desktop that retrieves policy from PGP Universal Server, you must first delete the PGP Corporation folder in %ALLUSERSPROFILE%\Application Data. If you do not delete this folder, your new PGP Desktop installation will not receive policy from the PGP Universal Server. [13252] PGP Keys Signature operations may download the private portion of the MAK key to the managed PGP Desktop, even if the key is SKM. These operations include signing a document and validating the signature on a document. Downloading the private portion of certain types of keys may be a security problem in some environments. [26106] In PGP Universal Server 3.1 and later, if you require verified keys, certificates of external users will not be trusted if the root certificate is not in the Trusted Key list. In previous versions of PGP Universal Server, the certificate was trusted if it was stored in the Key Cache. To replicate the behavior of previous versions, from the Send (encrypted/signed) mail policy action, do not select the option Require verified key. [26033] In PGP Universal Server 3.1, the server no longer returns an unverified key for encryption purposes when the key lookup request by clients is for a verified key. Administrators must select the unverified keys for their users, especially for external users using PGP Universal Satellite, and must manually trust these unverified keys by signing them with a key that the server trusts. [25836] On the Keys > Managed Keys page, the name associated with a managed key should be the primary address associated with the key, not the last listed address. [25115] Exporting or deleting tens of thousands of user keys at a time can take hours, or can fail. Export fewer keys at a time, or contact PGP Support for help. [15998] When making any changes that affect which TLS client certificates are permitted to access the Keyserver service, you must disable, and re-enable the Keyserver service for these changes to take effect. [6533] Messaging The Outbound Policy Chain in PGP Universal Server 3.1 contains three new rules: Sign + Encrypt Buttons, Sign Button, and Encrypt Button. If you import the Outbound policy chain from an earlier version of the PGP Universal Server, either through an upgrade/migration or by importing the policy chain, these three rules are deleted from the Outbound policy chain. If you want them in the policy chain, you must add them back manually. See the PGP Universal Server Administrator's Guide for further information, and for instructions on how to add these rules to the policy chain. [24799] To make the exported delivery receipts file for Certified Delivery display Japanese characters correctly, you must save the file as UTF Export the CSV file. 2. Open and save the file as UTF-8. Use an editor that supports UTF-8. File converts to UTF-8 format. [24466] Logging error: When an imported external user key is used to encrypt outgoing messages, the logs report that the key was found with in Internal User Keys, rather than External User Keys. [23757] Sending concurrent PDF Messenger messages to large numbers of recipients is not recommended. Limit the number of concurrent recipients to 200 at a time. [17751] If a user's Thunderbird client is set to send in HTML-only format, and the message is encrypted by either PGP Universal Server or PGP Desktop before it arrives at the BES gateway, the recipient will be unable to view the message on his or her BlackBerry. To work around this issue, configure the Thunderbird client so that it does not send HTML-only messages. [16273] When a large PDF Messenger or PGP Universal Web Messenger message is sent out of the mail stream, the connection to the PGP Universal Server times out before the mail is sent. [15916] Microsoft Windows Mail in Windows Vista may incorrectly deliver the PGP Desktop enrollment message to the Junk E- mail folder, instead of to the Inbox. If using that client in a managed setting, please disable the Junk feature. [13149] Microsoft Outlook 2007 uses extensive processing time to handle extremely large HTML attachments. The connection with

13 the PGP Universal Server may time out before the message can be sent. [12545] Characters added in versions of Unicode after 3.0 are not supported in PGP Universal Server Dictionaries. [10367] Some of the more obscure authentication methods for POP/IMAP/SMTP may not work through PGP Universal Server. We recommend always activating SSL/TLS between your client machines and PGP Universal Server. If you are also deploying PGP Universal Satellite internally, it will automatically probe for SSL/TLS on the server and upgrade mail connections to use it whenever possible. Plain, Login, MSN, NTLM, and CRAM- MD5 authentication are officially supported in this release. [NBN] Stalker's CommuniGate Pro mailserver contains a MAPI client adapter to redirect MAPI over IMAP. This adapter is not currently compatible with PGP Universal Satellite. [2430] PGP Universal Web Messenger Depending on your Microsoft Windows version, opening files with non-latin filenames directly from PGP Universal Web Messenger may result in garbled filenames. To avoid this problem, save attachments to your desktop before opening them. [12011] Replies to PGP Universal Web Messenger messages may not work if a load balancer is directing traffic for the untrusted interfaces of a cluster of PGP Universal Servers in gateway placement. A workaround is to disable any rules your hardware may enforce that prohibit traffic to a virtual server from a member of the load balancing pool. Check with your hardware vendor to determine if this is possible. [NBN] PGP Universal Web Messenger mailbox quotas of up to 2 GB are supported for this release. [7986] PGP Whole Disk Encryption Disabling the Enable Whole Disk Recovery Tokens Consumer Policy setting does not work for PGP Desktop for Mac OS X. Whole Disk Recovery Tokens are still sent to PGP Universal Server. [28397] If consumer policy requires disk encryption, but the user pauses the encryption process and then decrypts the disk, PGP Desktop for Windows does not immediately prompt the user to re-encrypt the disk. The encryption prompt does not appear until the user either restarts PGP Tray or logs out and then logs back in again. [28393] In the PGP Remote Disable & Destroy feature, Mac OS X computers appear as AT Deactivated, rather than Unsupported. [28106] PGP Universal Server s log files do not show when a user logs in to an encrypted computer using Local Self-Recovery. [27829] On the Consumers > Devices > WDE Computers page, the status of partially encrypted disks appears as "None encrypted." [26825] Users should not have more than 100 Whole Disk Recovery Tokens. When you try to view user information for users with a large number of WDRTs, PGP Universal Server may timeout. [25498] Bad sector log entries in the Client log on the PGP Universal Server do not report the correct number of bad sectors, and may erroneously report 0. When no bad sectors are encountered, there are no log entries referring to bad sectors. [18105] The PGP Whole Disk Encryption "Force Encrypt" setting is not set and enforced correctly after upgrade. If you are using this option, review and verify your policy because you now have more settings you can choose. [17793] The PGP Universal Server does not display encrypted device status on the Internal User Information screen for PGP Desktop prior to 9.7, and instead displays the "Unknown" status for all such devices. To see encrypted device status, you must upgrade the client to 9.7 or later. [15606] PGP Universal Server does not validate images uploaded for use with PGP BootGuard. For more information on creating, uploading, and testing images, see Knowledge Base article 885. [15457] PGP NetShare PGP NetShare is not updated when you replace your Organization ADK with a new ADK. You must re-encrypt the PGP NetShare folder to the new ADK. [22866] Files protected by application-based encryption policy (white-listed applications) are locked (requiring authentication to access) only after the user associated with the policy logs off or shuts down the system. [17491] Getting Assistance

14 Available Documentation Documentation is available on the Documentation disc as well as from the PGP Universal Server administrative interface. Online Help is also available via the administrative interface for each screen. Prior to installation, complete Product Documentation is available through the PGP Corporation Support Portal. The PGP Universal Server Administrator's Guide (pgpuniversal.pdf) is an Adobe Acrobat Portable Document Format (PDF) file. You can view and print this file with Adobe Acrobat Reader, included on the Documentation disc and also available on the Adobe website. Documentation feedback is welcome. Send comments to or visit the Documentation forum. Contacting Technical Support Contacting Technical Support To learn about PGP support options and how to contact PGP Technical Support, please visit the PGP Corporation Support Home Page. To access the PGP Support Knowledge Base or request PGP Technical Support, please visit PGP Support Portal Web Site. Note that you may access portions of the PGP Support Knowledge Base without a support agreement; however, you must have a valid support agreement to request Technical Support. To access the PGP Support forums, please visit PGP Support. These are user community support forums hosted by PGP Corporation. Contacting Customer Service For help with orders, downloads, and licensing, please visit PGP Corporation Customer Service. Contacting Other Departments For any other contacts at PGP Corporation, please visit the PGP Contacts Page. For general information about PGP Corporation, please visit the PGP Web Site. Copyright and Trademarks Copyright (c) 2011 PGP Corporation. All Rights Reserved. PGP, Pretty Good Privacy, and the PGP logo are registered trademarks and PGP Universal is a trademark of PGP Corporation in the U.S. and other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners.