PGP Universal(TM) Server Version 3.0 Release Notes

Transcription

1 PGP Universal(TM) Server Version 3.0 Release Notes Thank you for using this PGP Corporation product. These Release Notes contain important information regarding this release of PGP Universal Server. PGP Corporation strongly recommends you read this entire document. PGP Corporation welcomes your comments and suggestions. Please use the information provided in Getting Assistance to contact us. Product: PGP Universal Server Version: Warning: Export of this software may be restricted by the U.S. government. Note: To view the most recent version of this document, please go to the PGP Support Portal and view the Knowledge Base article PGP User Guides, Administrator Guides, Quick Start Guides, and Release Notes. About PGP Universal Server PGP Universal Server provides your enterprise with secure messaging: it transparently protects your messages without user interaction. It automatically creates and maintains a Self-Managing Security Architecture (SMSA) by monitoring authenticated users and their traffic. You can also send protected messages to addresses that are not part of the SMSA. The PGP Universal Server encrypts, decrypts, signs, and verifies messages, providing strong security through policies you control. PGP Universal Satellite provides security for messages all the way to the computer of the user, it allows external users to become part of the SMSA, and it gives end users the option to create and manage their keys on their own computer. Note to PGP Universal Server Technology Partner Edition users If you purchased PGP Universal Server Technology Partner Edition, many features described in the documentation are not available. If you want to upgrade to the full version of PGP Universal Server, please visit the PGP Web Site. To determine if you have this version, navigate to the System/System Settings screen. If you have this version, your license information includes the words PGP Universal Server Technology Partner Edition. Common Criteria Environments To be Common Criteria compliant, please refer to the best practices shown in PGP Universal Server 2.9 Common Criteria Supplemental. Note that these best practices supersede recommendations made elsewhere in this and other documentation. What's Included in This File

2 About PGP Universal Server Changes in This Release System Requirements Upgrade/Migration Requirements Additional Information Getting Assistance Copyright and Trademarks Changes in This Release This section lists the changes and new features in PGP Universal Server in this release. Note: All documents in this release are in draft form. Information may be missing, incomplete, or out of date. Note on Upgrading Clusters Important: For PGP Universal Server version 3.0.0, migration of clusters running in Home Server mode is not supported. Further, migration of clusters with more than two members, or migration of a single PGP Universal Server with more than 25,000 internal users, or more than 150,000 external users is also not supported at this time. PGP will provide a script you can run on your Universal Server installation to determine if it meets the requirements for upgrading at this time. See the most recent PGP Universal Server Release Notes, available on the PGP Support Web Portal, or contact your PGP support representative. What's New in PGP Universal Server 3.0 This release of PGP Universal Server introduces the following new and improved features: General Client policy management changes: Internal users, external users, PGP Verified Directory users, and devices are now called consumers. Consumers are sorted into groups manually, by user type, or by matching consumer attributes to domains, dictionary entries or through LDAP values. Group membership determines which policy consumers receive. Expanded directory synchronization: The integrated directory synchronization feature now connects to multiple LDAP directories. Previous versions of PGP Universal Server could only connect to one corporate directory at a time. Managed PGP Mobile: PGP Universal Server now manages client policy for PGP Mobile installations. Operating system change: The new CentOS operating system improves scalability and reliability, and supports a wider variety of hardware. RSA SecurID support for administrator authentication: PGP Universal Server now supports

3 PGP Keys two-factor authentication using RSA SecurID. This meets strong authentication requirements for environments with higher security needs, and is compatible with existing RSA SecurID deployments. Key Management Server (KMS): The new key management feature provides new and expanded key management capabilities for PGP products. Key policy changes are now immediately enforced. KMS allows management of asymmetric and symmetric keys. The API and SDK provide key management functionality to non-pgp applications. Server Key Mode offline use: The client can now store the SKM private key, encrypted to a random passphrase, so users can read offline. PGP Messaging ADK archival output: Administrators can archive end-to-end encrypted messages by decrypting the messages on PGP Universal Server using the ADK, and sending the decrypted messages to an archive server. Encrypted messages are then searchable, making possible compliance with regulatory mandates and requirements for message retention, mail server data management, and legal discovery support. Recursive encoding: Provides an additional layer of protection to messages that have been partially protected and to messages that have been signed. Supports an additional layer of encoding if the initial layer is not complete. Clustering New clustering functionality: Cluster members now interact with each other as peers, replacing the previous Primary/Secondaries model. Every server in a cluster can serve all types of requests, and any server can initiate persistent changes. The new cluster model also permits up to 20 nodes in a cluster. Resolved Issues For a list of issues that have been resolved in this release, please go to the PGP Support Portal and view Knowledge Base article PGP Portable licenses are now included and enforced on PGP Universal Server 3.0. If you are using PGP portable, update your license before you upgrade to PGP Universal Server 3.0. [26031] You can now use advanced search to look for keys by using the 32-bit version of the Key ID, with or without the 0x prefix. You cannot search on the full 64-bit Key ID. [24160] The list of supported time zones is updated and corrected. [24207] PGP Desktop users may use either their samaccountname or UPN values when enrolling to PGP Universal Server, when PGP Universal Server is configured to use LDAP synchronization for internal users. [22412] PGP Universal Server now accepts LDAP directories defined by valid hostname, fully qualified hostname, or IP address. [21832] PGP Universal Server no longer lists the administrator usernames in its LDAP hierarchy. [21196] Improved VMWare Tools support. [18933]

4 External users can now have multiple certificates, so both signing and encryption certificates can be imported. [16726] System Requirements PGP Universal Server is a customized Linux OS installation; it cannot be installed on a Windows server. Every PGP Universal Server requires a dedicated system that meets the system requirements listed below. The installation process deletes all data on the system and reconfigures it as a PGP Universal Server. PGP Universal Server Certified Hardware List - Valid 12/15/09 through 12/15/10 Please obtain the latest copy of this list for hardware purchasing decisions after 03/03/10. The following systems are certified for use as the hardware for PGP Universal Server: 1. Dell PowerEdge R610 - Two Quad-Core Intel XEON 2GHz - 4 GB RAM Two 146 GB 10K 2.5" SAS HD - SAS 6/iR RAID Broadcom BCM5709 network controller Small/medium environment production unit 2. Dell PowerEdge R710 - Two Quad Core Intel XEON 2.4GHz - 8 GB RAM Two 146 GB 15K SAS HD - SAS 6/iR RAID Broadcom BCM5709 network controller Medium/large environment production unit, cluster member 3. IBM System x3250 M2 - Quad-Core Intel XEON 3.16 GHz - 5 GB RAM Two x 150 GB SAS - LSI Logic SAS1064E ir RAID Broadcom BCM5722 network controller Medium/large environment production unit, cluster member 4. IBM System x3650 M2 - Two Intel XEON 2.4 GHz - 10 GB RAM Two 146 GB SAS 10K RPM - LSI Logic 1068E ir RAID Broadcom BCM5709 network controller Medium/large environment production unit, cluster member 5. IBM System x3650 M2 - Two Quad Core Intel XEON 2.4 GHz - 10 GB RAM Two 300 GB SAS 10K RPM - IBM ServRAID-MR 10i disk controller Broadcom BCM5709 Gigabit Ethernet Medium/large environment production unit, cluster member 6. IBM BladeCenter HS22 - Two Intel XEON 2.4 GHz - 8 GB RAM Two 146 GB SAS 10K RPM - LSI Logic 1068E ir RAID Broadcom BCM5709S network controller Small/medium environment production unit 7. HP Proliant DL120 G5 - Intel XEON X GHz - 2 GB RAM Two 250 GB SATA Broadcom BCM5722 network controller Small/medium environment production unit 8. HP ProLiant DL380 G6- Intel XEON 2.4 GHz - 6 GB RAM

5 Two 146 GB SAS 10K RPM - Smart Array P410i RAID Broadcom BCM5709 network controller Medium/large environment production unit, cluster member 9. VMWare ESX 3.5.0, Supported platform, non-hardware. Sufficient processing power equivalent to a 3 GHz Intel Xeon must be dedicated to the PGP Universal Server VM. VMWare tools must be installed and configured inside the PGP Universal Server operating system. VMWare ESX 4.0 is certified without VMotion. Disk space requirements: Small/medium environment - 50 GB minimum allocated to the VMWare instance; 4 GB RAM dedicated to the VMWare instance. Medium/large environment GB minimum allocated to the VMWare instance; 8 GB RAM dedicated to the VMWare instance. While a broad array of other hardware may work well with PGP Universal Server, incompatibilities related to hardware that is not one of the above systems will not be supported. To qualify as PGP Universal Server Certified Hardware, the server must be one of the models listed and all components must be configured as specified. Changing the sizes of hard disks within the same type of drive (for example, 36 GB SCSI to 73 GB SCSI), increasing memory configurations, and increasing processor speeds within the same type and family qualifies as the same system for Support purposes. Mailserver Requirements PGP Universal Server is compatible with many mailservers. However, it is tested and supported on the most common mailservers. Mailservers not on this list may not be fully compatible or supported: Microsoft Exchange Server 2007 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2000 SP3 Lotus Domino Server Lotus Domino Server 6.5 Lotus Domino Server Stalker Communigate Note that in addition to Microsoft Exchange Server 5.5 not being a supported mailserver, it has known incompatibilities, including an incompatibility with the LDAP Directory Synchronization feature. Additionally, limited testing is performed with the following open-source mailservers: postfix 2.X sendmail 8.X uw-imapd 2002 and 2004 popa3d 0.6.4

6 qpopper 4.0.X exim 3.36 and 4.X Cyrus PGP Corporation Compatibility Status with Microsoft Exchange Server 2007 PGP Corporation is pleased to announce compatibility with Microsoft's new Exchange Server PGP Desktop 9.6 introduced support for Microsoft Exchange Server 2007 and Microsoft Office When used with Internet-standard PGP/MIME (RFC 3156) messages, full message fidelity is preserved for all secured messages. With Exchange Server 2007, Microsoft has introduced a change in functionality that converts all messages to its internal MAPI format immediately upon processing, unlike previous versions of Exchange that supported the MIME standard for . Exchange Server 2007, when both sending and receiving via non-mapi clients, destroys MIME structures in . However, PGP/MIME-encoded messages are fully compatible with this Microsoft transition even when MAPI is not in use. All messages sent between PGP Corporation's MAPI clients are also fully compatible. Please note that messages encoded using the legacy "PGP Partitioned" format may not always display HTML message content properly, and foreign character sets in such messages may not reproduce correctly when processed through Exchange Server If such messages are processed from non- MAPI clients, the server may delete some encrypted HTML body parts and remove non-ascii character set information, thus resulting in messages that do not preserve full fidelity. If your organization currently uses the legacy PGP Partitioned encoding with non-mapi clients, PGP Corporation recommends not upgrading to Exchange Server 2007 at this time. PGP Corporation is working with Microsoft to seek additional solutions for compatibility between Exchange Server and the MIME standard. PGP Corporation will update the Support Knowledge Base Article #713 as more information becomes available. PGP Universal Server Administrative Interface Web Browser Requirements Windows Mac OS X Internet Explorer 6 and greater Firefox 1.0 and greater Safari 1.0 and greater Firefox 1.0 and greater PGP Universal Web Messenger Web Browser Requirements The PGP Universal Server administrative interface has been fully tested with the following Web browsers: Windows 2000 Professional and Advanced Server: Mozilla Firefox 3.0, Internet Explorer 6.0, Internet Explorer 7.0 Windows XP Professional and Pro x64: Mozilla Firefox 3.0, Internet Explorer 6.0, Internet Explorer 7.0

7 Windows Vista: Mozilla Firefox 3.0, Internet Explorer 7.0 Mac OS X 10.4: Mozilla Firefox 3.0, Safari 2.0 Mac OS X 10.5: Mozilla Firefox 3.0, Safari 3.1 While you might find that the administrative interface works with other Web browsers, we recommend these browsers for maximum compatibility. PGP Universal Satellite for Windows Requirements Microsoft Windows 2000 (Service Pack 4),Windows Server 2003 (Service Pack 1 and 2), Windows XP Professional 32-bit (Service Pack 2 or 3), Windows XP Professional 64-bit (Service Pack 2), Windows XP Home Edition (Service Pack 2 or 3), Microsoft Windows XP Tablet PC Edition 2005 (requires attached keyboard), Windows Vista (all 32- and 64-bit editions, including Service Pack 1 and 2), Windows 7 (all 32- and 64-bit editions). Note: The above operating systems are supported only when all of the latest hot fixes and security patches from Microsoft have been applied. PGP Whole Disk Encryption (WDE) is supported on all client versions above as well as the following Windows Server versions: Windows Server 2003 SP 2 (32- and 64-bit editions) Windows Server 2008 SP 1 and 2 (32- and 64-bit editions) Windows Server 2008 R2 (32- and 64-bit editions) 512 MB of RAM For additional system requirements and best practices information on using PGP WDE on Windows Server systems, see PGP KB article MB hard disk space PGP Universal Satellite for Mac OS X Requirements Mac OS X 10.5.x or 10.6.x (Intel or PowerPC) 512 MB of RAM 64 MB hard disk space 10.4.x removed, 10.6.x added. Nov. 2, 2009 Supported External Authentication Products PGP Universal Server is compatible with the following LDAP directory products: Microsoft Active Directory 2008 Microsoft Active Directory 2003 Microsoft Active Directory 2000 Lotus Notes/Domino Directory 7.0

8 OpenLDAP 2.3.x Lotus Notes/Domino Directory 6.5 For directory synchronization, PGP Universal Server supports: LDAPv2 LDAPv3 LDAPS For PGP Universal Web Messenger external authentication, PGP Universal Server supports: LDAPv2 LDAPv3 RSA Radius Server with RSA Authentication Manager 7.1 Anti-Virus Software Compatibility For information about antivirus compatibility, see the PGP Desktop for Windows Release Notes or the PGP Desktop for Mac OS X Release Notes. Upgrade/Migration Requirements Important: For PGP Universal Server version 3.0.0, migration of clusters running in Home Server mode is not supported. Further, migration of clusters with more than two members, or migration of a single PGP Universal Server with more than 25,000 internal users, or more than 150,000 external users is also not supported at this time. PGP will provide a script you can run on your PGP Universal Server installation to determine if it meets the requirements for upgrading at this time. See the most recent PGP Universal Server Release Notes, available on the PGP Support Web Portal, or contact your PGP support representative. There are two methods available for upgrading your PGP Universal Server: The migration process, where you back up data to an external location, install the new software version from CD, and the restore your data. Follow the instructions in the PGP Universal Server Installation Guide to perform an installation from CD. The PUP update process, where you download and install a PUP update file from within the administrative interface of your PGP Universal Server. This method automatically preserves your data and system settings. For instructions on performing a PUP update, see the PGP Universal Server Administrator's Guide. The upgrade to PGP Universal Server version requires a migration: you must back up your current system, install the upgrade from CD, and then restore your data. You can migrate to PGP Universal Server from version or later. If you are running a version prior to 2.7.0, you must first upgrade to There are special considerations for upgrading a cluster. For instructions on migrating a cluster, see Migrating a Cluster in thepgp Universal Server Upgrade Guide.

9 Important: Before you upgrade to PGP Universal Server 3.0.0, you must back up your data and your organization key to an external location. You will need your organization key to restore your backed-up data. You can migrate directly to PGP Universal Server version from any of the following previous versions: R2 Note: On PGP Universal Server 3.0.0, you can only restore backed-up data from version and later. To upgrade from version or 2.6.x you must first migrate to version To upgrade from a version prior to 2.5.3, you must first upgrade to and then upgrade to To upgrade from a version of PGP Universal Server prior to 2.5.3: 1. Log in to your PGP Universal Server administrative interface. 2. Back up your version 2.0.x system data to an external location. (See the PGP Universal Server Administrator's Guide for your software version for installation, backup and restore instructions and best practices.) 3. Migrate to version using the CD. Restore your backed-up data. 4. Back up your version data to an external location. 5. Migrate to version using the CD. Restore your backed-up data. 6. Go to 7. One at a time, download and install PUP updates for versions 2.5.1, 2.5.2, and Note: You do not need to back up and restore data when upgrading using a PUP file. However, it is always a good idea to have a current backup when performing maintenance tasks on PGP Universal Server. Note: When installing multiple PUP updates, download and install them one at a time. If you download multiple PUP updates before you begin installing them, only the first installation succeeds.

10 8. Back up your version data and organization key to an external location. 9. Migrate to version and restore your backed up data. 10. Back up your version data to an external location. 11. Upgrade to version using the CD. 12. Restore your backed-up data. To upgrade from PGP Universal Server or 2.6.x: 1. Log in to your PGP Universal Server administrative interface. 2. Back up your data and organization key to an external location. 3. Migrate to version and restore your backed up data. 4. Back up your version data to an external location. 5. Upgrade to version using the CD. 6. Restore your backed-up data. To upgrade from PGP Universal Server or later 1. Log in to your PGP Universal Server administrative interface. 2. Back up your data and organization key to an external location. 3. Upgrade to version using the CD. 4. Restore your backed-up data. Upgrade Best Practices As a best practice, PGP Corporation recommends that you test your upgrade in a lab environment before changing your production environment: Perform a fresh install on a test system in a lab environment, or upgrade/migrate an existing lab system running a previous version of PGP Universal Server. Test the lab system to ensure that your mail policies and other basic functionality of your server work as you expect. Migrate your live environment. See the PGP Universal Server Upgrade Guide for upgrade/migration information. Additional Information Please see the PGP Universal Satellite Release Notes installed with PGP Universal Satellite for additional information about that product. Installation After PGP Universal Server migrates to version 3.0, an error appears in the log saying that new

11 enrolling clients fail to request customized PGP Whole Disk Encryption BootGuard settings. This only appears for policies with no customized BootGuard settings. If there are customized settings, clients request and receive them. [26474] After you upgrade to PGP Universal Server 3.0, the next message your existing PDF Messenger users receive does not arrive as an encrypted PDF. Instead, users receive a link to their PGP Universal Web Messenger inbox, where they must enter their current passphrases; the message is then delivered. PGP Universal Server resaves the passphrases, and users get all future messages as delivered correctly as PDF Messenger messages. [26395] If you back up data from the Primary in a cluster, and restore the data to a new PGP Universal Server 3.0 installation, you cannot delete old cluster members unless the cluster member has a DNS-resolvable name. [26128] Sometimes, when you add a new member to a cluster, the sponsoring cluster member fails to immediately contact the new joining cluster member. Check the joining cluster member to see if it is waiting for contact from the sponsor. If it is, click the Contact button to try again. [25751] Before upgrading to PGP Universal Server 3.0 or later, make sure you do not have internal and external user policies with the same name. After migration, users will not receive the correct consumer policy. [23885] Restoring a backup of to a PGP Universal Server with a different IP address than the one stored in the backup does not change the IP address of the PGP Universal Server. [19918] When you back up data on one PGP Universal Server and then restore the data onto a different PGP Universal Server, MAC address information is incorrect. The MAC address on the restored PGP Universal Server is set to the MAC address of the backed-up PGP Universal Server. This cannot be fixed through the user interface. Contact PGP Support to correct the MAC address. [19895] After PUP updates, the screen is formatted incorrectly. Workaround: clear the cache or refresh the browser screen. [18011] Do not use international characters when specifying file names for backup files. [10834] Deployment Key lookups that originate from sending may result in PGP Universal Server doing additional lookups for internal users when those internal users have a PGP Desktop policy with messaging disabled. [26327] If a PGP Desktop user is moved from the excluded user group to an internal user group, the user may not download policy for the new group, and may continue to use the policy previously downloaded for the excluded user group. To ensure that the user properly downloads and follows policy, make any update to the policy for the new group. [26263] PGP Universal Server does not correctly follow LDAP referrals for directory synchronization. [26107] When you login in to a new cluster member while the member is in the joining process, some data may not display properly when you navigate through the interface. This happens because data is being replicated and the new cluster member configuration is changing. Log off and wait until the cluster join is complete. [26057] When the PGP Universal Server is set to look for a consumer in all ordered LDAP directories if that consumer cannot be matched to an LDAP directory, and LDAP Referrals are enabled, and if the first serve on the list is an Active Directory, if the consumer is not in the first of the ordered

12 directories, PGP Universal Server does not continue searching the rest of the directories. [25975] HTTP-based services do not support port numbers higher than [25784] If you configure multiple LDAP servers, and the first is unavailable, PGP Universal Server does not continue to search for users in the other listed servers. [25587] PGP Universal Server does not provide out-of-the-box support for LDAP synchronization in environments where multiple LDAP servers contain identical samaccountname values for different users. If your environment contains multiple LDAP domains with some users having identical samaccountname values, please contact PGP Support for guidance on how to deploy PGP Universal Server into your environment. [25299] When you create a client installer, if the domain for the PGP Universal Server specified in the Download Clients dialog box does not match a managed domain, silent enrollment does not work. [25046] When you install a new client with a new consumer group policy on an existing client computer, and LDAP enrollment is not enabled, the user is not moved to the new consumer group associated with that policy and does not receive the new policy. Workaround: Manually move the user to the correct consumer group. [24898] If you add PGP Universal Server to its own keyserver list at Keys > Keyservers, you must add it using the IP address. If you add it using the PGP Universal Server hostname, key lookups on that keyserver fail. [24698] When you set a group to match disabled users in Active Directory, PGP Universal Server matches all disabled users in the directory, ignoring any specified LDAP attribute/value pairs for that group. [23827] When you enable the setting to encrypt client sent folder contents, the prepopulated list of IMAP sent folder names is empty. Add the following sent folder names to PGP Universal Server to be matched: SENT SENT * GESENDETE GESENDETE *????????????* [23783] If communication between PGP Universal Server and your HSM is interrupted, you must re-start PGP Universal Server once communication has been re-established. [23739] To create a mail policy rule for expanding the To list for messages to mailing lists, make sure the conditions are in the correct order, or the rule is not applied. The correct order for the conditions must be: 1. Recipient domain <is/contains/matches>. 2. 'Recipient address is mailing list' 3. 'Mailing list user count is' <greater than/fewer than> [23723]

13 Sometimes, after you request the deletion of a cluster member, the deletion may not propagate fully around the cluster. In this case, it is safe to repeat the deletion action as necessary. [23694] PGP Universal Server 3.0 does not support SSL v1.0 certificates. [25378] With Microsoft Internet Explorer 8, security can be set to a HIGH state, which disables Javascript on most web pages. With Javascript disabled, PGP Universal Server's management console (administrative interface) and PGP Universal Web Messenger login will not function. Make security exceptions for PGP Universal Server in IE 8's security settings, or use a different browser to access the administrative interface. [23688] When clients with embedded consumer policy enroll it will, if required by policy, attempt to send key reconstruction data to the PGP Universal Server and fail. [23579] PGP NetShare is not updated when you replace your Organization ADK with a new ADK. You must re-encrypt the PGP NetShare folder to the new ADK. [22866] Silent Enrollment is only fully supported with Server Key Mode. During enrollment with other key modes, the user is prompted to enter a username and passphrase. [22709] When a NIC is set to a custom link mode, rather than auto-negotiate, the network driver no longer advertises other link speeds. PGP Universal Server requires access to the list of possible link speeds to populate the Network Settings Link Speed menu. If you want to change the Link Speed from a custom setting, and no other custom settings appear, select Auto from the menu. Restart PGP Universal Server. After restart, the Link Speed menu is populated with all available options for the NIC. [19287] MAC ID, MTU, and Link Speed are not applicable to PGP Universal Server hosted on VMWare because the ESX server controls the network settings. However, when you create a new virtual interface, those settings are automatically populated. If your PGP Universal Server runs on VMWare and you want to create a new interface or edit an existing interface, you cannot save your changes until you clear the auto-populated MTU, MAC ID, and Link Speed settings. [19810] Organization Keys with Japanese passphrases cannot be imported. [18620] The Silent Enrollment option does not work with existing certificates or keys, including CAPI and token keys. [16044] You cannot use spaces in the name of the backup FTP server. [15491] Recovery from a Windows PE environment requires the use of a Whole Disk Recovery Token. TPM and hardware token users cannot be authenticated from within Windows PE. [15101] To replace an installation of PGP Desktop with embedded policy with an installation of PGP Desktopp that retrieves policy from PGP Universal Server, you must first delete the PGP Corporation folder in %ALLUSERSPROFILE%\Application Data. If you do not delete this folder, your new PGP Desktop installation will not receive policy from the PGP Universal Server. [13252] PGP Keys In PGP Universal Server 3.0, the server no longer returns an unverified key for encryption purposes when the key lookup request by clients is for a verified key. Administrators must select the unverified keys for their users, especially for external users using PGP Universal Satellite, and must manually trust these unverified keys by signing them with a key that the server trusts. [25836] On the Keys > Managed Keys page, the name associated with a managed key should be the primary address associated with the key, not the last listed address. [25115] In PGP Universal Server 3.0 and later, if you require verified keys, certificates of external users will

14 not be trusted if the root certificate is not in the Trusted Key list. In previous versions of PGP Universal Server, the certificate was trusted if it was stored in the Key Cache. To replicate the behavior of previous versions, from the Send (encrypted/signed) mail policy action, do not select the option Require verified key. Exporting or deleting tens of thousands of user keys at a time can take hours, or can fail. Export fewer keys at a time, or contact PGP Support for help. [15998] When making any changes that affect which TLS client certificates are permitted to access the Keyserver service, you must disable, and re-enable the Keyserver service for these changes to take effect. [6533] Messaging The Outbound Policy Chain in PGP Universal Server 3.0 contains three new rules: Sign + Encrypt Buttons, Sign Button, and Encrypt Button. If you import the Outbound policy chain from an earlier version of the PGP Universal Server, either through an upgrade/migration or by importing the policy chain, these three rules are deleted from the Outbound policy chain. If you want them in the policy chain, you must add them back manually. See the PGP Universal Server Administrator's Guide for further information, and for instructions on how to add these rules to the policy chain. [24799] To make the exported delivery receipts file for Certified Delivery display Japanese characters correctly, you must save the file as UTF Export the CSV file. 2. Open and save the file as UTF-8. Use an editor that supports UTF-8. File converts to UTF-8 format. [24466] Logging error: When an imported external user key is used to encrypt outgoing messages, the logs report that the key was found with in Internal User Keys, rather than External User Keys. [23757] Sending concurrent PDF Messenger messages to large numbers of recipients is not recommended. Limit the number of concurrent recipients to 200 at a time. [17751] If a user's Thunderbird client is set to send in HTML-only format, and the message is encrypted by either PGP Universal Server or PGP Desktop before it arrives at the BES gateway, the recipient will be unable to view the message on his or her BlackBerry. To work around this issue, configure the Thunderbird client so that it does not send HTML-only messages. [16273] When a PDF Messenger message with a large attachment is sent out of the mail stream, the connection to the PGP Universal Server times out before the mail is sent. [15916] Microsoft Windows Mail in Windows Vista may incorrectly deliver the PGP Desktop enrollment message to the Junk folder, instead of to the Inbox. If using that client in a managed setting, please disable the Junk feature. [13149] Microsoft Outlook 2007 uses extensive processing time to handle extremely large HTML attachments. The connection with the PGP Universal Server may time out before the message can be sent. [12545]

15 Characters added in versions of Unicode after 3.0 are not supported in PGP Universal Server Dictionaries. [10367] Some of the more obscure authentication methods for POP/IMAP/SMTP may not work through PGP Universal Server. We recommend always activating SSL/TLS between your client machines and PGP Universal Server. If you are also deploying PGP Universal Satellite internally, it will automatically probe for SSL/TLS on the server and upgrad connections to use it whenever possible. Plain, Login, MSN, NTLM, and CRAM- MD5 authentication are officially supported in this release. [NBN] Stalker's CommuniGate Pro mailserver contains a MAPI client adapter to redirect MAPI over IMAP. This adapter is not currently compatible with PGP Universal Satellite. [2430] PGP Universal Web Messenger Depending on your Microsoft Windows version, opening files with non-latin filenames directly from PGP Universal Web Messenger may result in garbled filenames. To avoid this problem, save attachments to your desktop before opening them. [12011] Replies to PGP Universal Web Messenger messages may not work if a load balancer is directing traffic for the untrusted interfaces of a cluster of PGP Universal Servers in gateway placement. A workaround is to disable any rules your hardware may enforce that prohibit traffic to a virtual server from a member of the load balancing pool. Check with your hardware vendor to determine if this is possible. [NBN] PGP Universal Web Messenger mailbox quotas of up to 2 GB are supported for this release. [7986] PGP Whole Disk Encryption Users should not have more than 100 Whole Disk Recovery Tokens. When you try to view user information for users with a large number of WDRTs, PGP Universal Server may timeout. [25498] Bad sector log entries in the Client log on the PGP Universal Server do not report the correct number of bad sectors, and may erroneously report 0. When no bad sectors are encountered, there are no log entries referring to bad sectors. [18105] The PGP Whole Disk Encryption "Force Encrypt" setting is not set and enforced correctly after upgrade. If you are using this option, review and verify your policy because you now have more settings you can choose. [17793] The PGP Universal Server does not display encrypted device status on the Internal User Information screen for PGP Desktop prior to 9.7, and instead displays the "Unknown" status for all such devices. To see encrypted device status, you must upgrade the client to 9.7 or later. [15606] PGP Universal Server does not validate images uploaded for use with PGP BootGuard. For more information on creating, uploading, and testing images, see Knowledge Base article 885. [15457] PGP NetShare Files protected by application-based encryption policy (white-listed applications) are locked (requiring authentication to access) only after the user associated with the policy logs off or shuts down the system. [17491] Getting Assistance

16 Available Documentation Documentation is available on the Documentation disc as well as from the PGP Universal Server administrative interface. Online Help is also available via the administrative interface for each screen. Prior to installation, complete Product Documentation is available through the PGP Corporation Support Portal. The PGP Universal Server Administrator's Guide (pgpuniversal.pdf) is an Adobe Acrobat Portable Document Format (PDF) file. You can view and print this file with Adobe Acrobat Reader, included on the Documentation disc and also available on the Adobe website. Documentation feedback is welcome. Send comments to or visit the Documentation forum. Contacting Technical Support Contacting Technical Support To learn about PGP support options and how to contact PGP Technical Support, please visit the PGP Corporation Support Home Page. To access the PGP Support Knowledge Base or request PGP Technical Support, please visit PGP Support Portal Web Site. Note that you may access portions of the PGP Support Knowledge Base without a support agreement; however, you must have a valid support agreement to request Technical Support. To access the PGP Support forums, please visit PGP Support. These are user community support forums hosted by PGP Corporation. Contacting Customer Service For help with orders, downloads, and licensing, please visit PGP Corporation Customer Service. Contacting Other Departments For any other contacts at PGP Corporation, please visit the PGP Contacts Page. For general information about PGP Corporation, please visit the PGP Web Site. Copyright and Trademarks Copyright PGP Corporation. All Rights Reserved. "PGP", "Pretty Good Privacy", and the PGP logo are registered trademarks and PGP Universal is a trademark of PGP Corporation in the U.S. and other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners.