1st Email Address Verifier 1.10 serial key or number

1st Email Address Verifier 1.10 serial key or number

1st Email Address Verifier 1.10 serial key or number

1st Email Address Verifier 1.10 serial key or number

AWS Service Terms

* Please note that as of June 10, , AWS is implementing a one-year moratorium on use of Amazon Rekognition’s face comparison feature by police departments in connection with criminal investigations. This moratorium does not apply to use of Amazon Rekognition’s face comparison feature to help identify or locate missing persons. For more information, see our announcement on our Amazon Day One Blog.

Last Updated: September 10,

The Service Terms below govern your use of the Services. Capitalized terms used in these Service Terms but not defined below are defined in the AWS Customer Agreement or other agreement with us governing your use of the Services (the “Agreement”). For purposes of these Service Terms, “Your Content” includes any “Company Content” and any “Customer Content,” and “AWS Content” includes “Amazon Properties.”

1. Universal Service Terms (Applicable to All Services)

You may not transfer outside the Services any software (including related documentation) you obtain from us or third party licensors in connection with the Services without specific authorization to do so.

You must comply with current technical documentation applicable to the Services (including applicable developer guides) posted on the AWS Site.

You will provide information or other materials related to Your Content (including copies of any client-side applications) as reasonably requested by us to verify your compliance with the Agreement. You will reasonably cooperate with us to identify the source of any problem with the Services that we reasonably believe may be attributable to Your Content or any end user materials that you control.

In connection with your use of the Services, you are responsible for maintaining licenses and adhering to the license terms of any software you run. If we reasonably believe any of Your Content violates the law, infringes or misappropriates the rights of any third party, or otherwise violates a material term of the Agreement (including the documentation, the Service Terms, or the Acceptable Use Policy) (“Prohibited Content”), we will notify you of the Prohibited Content and may request that such content be removed from the Services or access to it be disabled. If you do not remove or disable access to the Prohibited Content within 2 business days of our notice, we may remove or disable access to the Prohibited Content or suspend the Services to the extent we are not able to remove or disable access to the Prohibited Content. Notwithstanding the foregoing, we may remove or disable access to any Prohibited Content without prior notice in connection with illegal content, where the content may disrupt or threaten the Services or in accordance with applicable law or any judicial, regulatory or other governmental order or request. In the event that we remove Your Content without prior notice, we will provide prompt notice to you unless prohibited by law. We terminate the accounts of repeat infringers in appropriate circumstances.

You will ensure that all information you provide to us via the AWS Site (e.g., information provided in connection with your registration for the Services, requests for increased usage limits) is accurate, complete, and not misleading.

From time to time, we may apply upgrades, patches, bug fixes, or other maintenance to the Services and AWS Content (“Maintenance”). We agree to use reasonable efforts to provide you with prior notice of any scheduled Maintenance (except for emergency Maintenance), and you agree to use reasonable efforts to comply with any Maintenance requirements that we notify you about.

If your Agreement does not include a provision on AWS Confidential Information, and you and AWS do not have an effective non-disclosure agreement in place, then you agree that you will not disclose AWS Confidential Information (as defined in the AWS Customer Agreement), except as required by law.

You may perform benchmarks or comparative tests or evaluations (each, a “Benchmark”) of the Services. If you perform or disclose, or direct or permit any third party to perform or disclose, any Benchmark of any of the Services, you (i) will include in any disclosure, and will disclose to us, all information necessary to replicate such Benchmark, and (ii) agree that we may perform and disclose the results of Benchmarks of your products or services, irrespective of any restrictions on Benchmarks in the terms governing your products or services.

Only the applicable AWS Contracting Party (as defined in the AWS Customer Agreement) will have obligations with respect to each AWS account, and no other AWS Contracting Party has any obligation with respect to such account. The AWS Contracting Party for an account may change as described in the Agreement. Invoices for each account will reflect the AWS Contracting Party that is responsible for that account during the applicable billing period.

If, as of the time of a change of the AWS Contracting Party responsible for your account, you have made an up-front payment for any Services under such account, then the AWS Contracting Party you paid such up-front payment to may remain the AWS Contracting Party for the applicable account only with respect to the Services related to such up-front payment.

When you use a Service, you may be able to use or be required to use one or more other Services (each, an “Associated Service”), and when you use an Associated Service, you are subject to the terms and fees that apply to that Associated Service.

If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data. You represent to us that you have provided all necessary privacy notices and obtained all necessary consents. You are responsible for processing such data in accordance with applicable law.

If you have been charged for a Service for a period when that Service was unavailable (as defined in the applicable Service Level Agreement for each Service), you may request a Service credit equal to any charged amounts for such period.

If you are a customer that is subject to the French Politique générale de sécurité des systems d’information de santé (PGSSI-S), you agree that your use of the Services complies with the PGSSI-S.

Data Protection.

These Service Terms incorporate the AWS GDPR Data Processing Addendum (“DPA”), when the GDPR applies to your use of the AWS Services to process Customer Data (as defined in the DPA).The DPA is effective as of 25 May and replaces and supersedes any previously agreed data processing addendum between you and AWS relating to the Directive 95/46/EC.

These Service Terms incorporate the AWS CCPA Terms (“CCPA Terms”), when the CCPA applies to your use of the AWS Services to process Personal Information (as defined in the CCPA Terms).

Following closure of your AWS account, we will delete Your Content in accordance with the Documentation.

Your receipt and use of any Promotional Credits is subject to the AWS Promotional Credit Terms & Conditions.

Payment Currency

AWS provides a Service that enables payment in certain currencies (“Payment Currency”) other than United States dollars when you purchase certain Services from AWS (the “Currency Service”). When you purchase Services in certain countries outside of the United States, we may require you, because of currency controls or other factors, to use the Currency Service. When using the Currency Service you are not tendering payment in one currency and receiving from us another currency.

When you use the Currency Service, Service fees and charges will automatically be invoiced in the Payment Currency. You must pay invoices in the currency specified on each invoice, but, for credit card or debit card purchases, you may only make payments in currencies supported by the issuer of your card. If the issuer of your credit card or debit card does not support the required Payment Currency, you must use a different payment method that does support paying in the Payment Currency.

Our fees and charges for your use of the Currency Service, if any, are included in the exchange rate applied to your invoice (the “Applicable Exchange Rate”). Third-parties, such as your bank, credit card issuer, debit card issuer, or card network, may charge you additional fees. The Applicable Exchange Rate is determined at the time your invoice is generated and, for invoices covering usage of Services over a period of time, will apply to all usage and Service charges listed on that invoice.

All refunds processed against an invoice will be provided in the currency in which the invoice was generated and reflected as a credit memo or a payment in your Payment Currency.

You agree that by using the Currency Service, information related to your payment, including your name and address, may be used by our banking partners to process your payments in jurisdictions other than the United States.

2. Betas and Previews

This Section describes the additional terms and conditions under which you may (a) access and use certain features, technologies, and services made available to you by AWS that are not yet generally available, including, but not limited to, any products, services, or features labeled “beta”, “preview”, “pre-release”, or “experimental”, and any related AWS Content (each, a “Beta Service”) or (b) access and use Services and any related AWS Content available in AWS regions that are not generally available, including, but not limited to, any AWS regions identified by AWS as “beta”, “preview”, “pre-release”, or “experimental” (each, a “Beta Region”).

You must comply with all terms related to any Beta Service or Beta Region as posted on the AWS Site or otherwise made available to you. AWS may add or modify terms, including lowering or raising any usage limits, related to access to or use of any Beta Services or Beta Regions at any time. Service Level Agreements do not apply to Beta Services or Beta Regions.

You may provide AWS with information relating to your access, use, testing, or evaluation of Beta Services or Beta Regions, including observations or information regarding the performance, features, and functionality of Beta Services or Beta Regions (“Test Observations”). AWS will own and may use and evaluate all Test Observations for its own purposes. You will not use any Test Observations except for your internal evaluation purposes of any Beta Service or Beta Region.

 AWS may suspend or terminate your access to or use of any Beta Service or Beta Region at any time. Your access to and use of each Beta Service and Beta Region will automatically terminate upon the release of a generally available version of the applicable Beta Service or Beta Region or upon notice of termination by AWS. Notwithstanding anything to the contrary in the Agreement, after suspension or termination of your access to or use of any Beta Service or Beta Region for any reason, (a) you will not have any further right to access or use the applicable Beta Service or Beta Region, and (b) Your Content used in the applicable Beta Service or Beta Region may be deleted or inaccessible.

Test Observations, Suggestions concerning a Beta Service or Beta Region, and any other information about or involving (including the existence of) any Beta Service or Beta Region are considered AWS Confidential Information.

 WITHOUT LIMITING ANY DISCLAIMERS IN THE AGREEMENT OR THE SERVICE TERMS, BETA SERVICES AND BETA REGIONS ARE NOT READY FOR GENERAL COMMERCIAL RELEASE AND MAY CONTAIN BUGS, ERRORS, DEFECTS, OR HARMFUL COMPONENTS. ACCORDINGLY, AND NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THE AGREEMENT OR THESE SERVICES TERMS, AWS IS PROVIDING BETA SERVICES AND BETA REGIONS TO YOU “AS IS.” AWS AND ITS AFFILIATES AND LICENSORS MAKE NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE REGARDING BETA SERVICES AND BETA REGIONS, INCLUDING ANY WARRANTY THAT THE BETA SERVICES AND BETA REGIONS WILL BECOME GENERALLY AVAILABLE, BE UNINTERRUPTED, ERROR FREE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY CONTENT, INCLUDING YOUR CONTENT, WILL BE SECURE OR NOT OTHERWISE LOST OR DAMAGED. EXCEPT TO THE EXTENT PROHIBITED BY LAW, AWS AND ITS AFFILIATES AND LICENSORS DISCLAIM ALL WARRANTIES, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR QUIET ENJOYMENT, AND ANY WARRANTIES ARISING OUT OF ANY COURSE OF DEALING OR USAGE OF TRADE. AWS’S AND ITS AFFILIATES’ AND LICENSORS’ AGGREGATE LIABILITY FOR ANY BETA SERVICES AND BETA REGIONS WILL BE LIMITED TO THE AMOUNT YOU ACTUALLY PAY US UNDER THIS AGREEMENT FOR THE SERVICES THAT GAVE RISE TO THE CLAIM DURING THE 12 MONTHS PRECEDING THE CLAIM.

3. Amazon CloudFront

You must own or have all necessary rights to use any domain name or SSL certificate that you use in conjunction with Amazon CloudFront. You are solely responsible for the renewal, security, and proper configuration of any SSL certificates that you provide for use with Amazon CloudFront, including any disclosure of your SSL certificates to third parties.

4. AWS Outposts

Outposts Equipment. AWS will make equipment available to you to support your use of the AWS Outposts Service (the “Outposts Equipment”). AWS or its affiliates maintain all rights in the Outposts Equipment and is not selling, renting, leasing, or transferring any ownership, intellectual or other rights in the Outposts Equipment to you. You will not, and will not purport to, assign, grant, or transfer the Outposts Equipment or any interest in the Outposts Equipment to any individual or entity, and any such purported assignment, grant or transfer is void.

Facility Assessment. You will ensure that, at all times, the facility at which the Outposts Equipment is located (the “Designated Facility”) meets the minimum requirements necessary to support the installation, maintenance, use, and removal of the Outposts Equipment as described here and otherwise as described in the Outposts Documentation or provided to you during the ordering and installation process.

Delivery and Use. You will ensure that you have all necessary rights, certifications, and licenses for the delivery, installation, maintenance, use, and removal of the Outposts Equipment at the Designated Facility. You are responsible for any damage to the Outposts Equipment while it is at the Designated Facility, unless caused by AWS. AWS may terminate your use of Outposts and remove the Outposts Equipment if you breach these terms or the terms of the Agreement with respect to Outposts.

Access to Outposts Equipment. You will give personnel designated by AWS prompt and reasonable access to the Designated Facility as necessary to deliver, install, inspect, maintain, and remove the Outposts Equipment. You will not require AWS personnel to sign, accept, or otherwise agree to any documentation as a condition of accessing the Designated Facility, and you agree that the terms of any such documentation are void even if signed by AWS personnel. You will ensure that no one accesses, moves, or repairs the Outposts Equipment other than (i) personnel designated by AWS, (ii) as permitted in writing by AWS in connection with the maintenance of Outposts Equipment, or (iii) as necessary due to a situation involving imminent injury, damage to property, or an active fire alarm system. You will ensure that no one modifies, alters, reverse engineers, or tampers with the Outposts Equipment. You acknowledge that the Outposts Equipment may be equipped with tamper monitoring.

Enterprise Support. You will remain enrolled in AWS Support at the Enterprise level during the entire period of your use of Outposts.

Services/SLAs/Security. The Service Terms for any Services that run locally on Outposts also apply to your use of those Services on Outposts. There are inherent differences between Services running locally on Outposts from those Services running at AWS operated facilities because the Outposts Equipment is physically located at the Designated Facility where you are responsible for physical security and access controls, as well as all power, networking, and environmental conditions. Due to these differences:

a. The Service Level Agreements for any Services that run locally on Outposts do not apply to your use of those Services on Outposts.

b. Any AWS commitments in the Agreement that depend on AWS’s operation of such physical security and access controls, or power, networking, and environmental conditions, do not apply to Outposts or any Services running locally on Outposts.

c. The security and compliance standards, certifications, audits, reports and attestations held by AWS do not apply to Outposts or any Services running locally on Outposts. You can find more information about Outposts security compliance and features here. 

5. Amazon Elastic Compute Cloud

In conjunction with the Services, you may be allowed to use certain software (including related documentation) developed and owned by Microsoft Corporation or its licensors (collectively, the “Microsoft Software”).

If you use the Microsoft Software, Microsoft and its licensors require that you agree to these additional terms and conditions:

  • The Microsoft Software is neither sold nor distributed to you, and you may use it solely in conjunction with the Services.
  • You may not transfer or use the Microsoft Software outside the Services.
  • You may not remove, modify, or obscure any copyright, trademark, or other proprietary rights notices that are contained in or on the Microsoft Software.
  • You may not reverse engineer, decompile, or disassemble the Microsoft Software, except to the extent expressly permitted by applicable law.
  • Microsoft disclaims, to the extent permitted by applicable law, all warranties by Microsoft and any liability by Microsoft or its suppliers for any damages, whether direct, indirect, or consequential, arising from the Services.
  • Microsoft is not responsible for providing any support in connection with the Services. Do not contact Microsoft for support.
  • You are not granted any right to use the Microsoft Software in any application controlling aircraft or other modes of human mass transportation, nuclear or chemical facilities, life support systems, implantable medical equipment, motor vehicles, weaponry systems, or any similar scenario (collectively, “High Risk Use”). Microsoft and its suppliers disclaim any express or implied warranty of fitness for High Risk Use. High Risk Use does not include utilization of the Microsoft Software for administrative purposes, to store configuration data, engineering and/or configuration tools, or other non-control applications, the failure of which would not result in death, personal injury, or severe physical or environmental damage. These non-controlling applications may communicate with the applications that perform the control, but must not be directly or indirectly responsible for the control function.
  • Microsoft is an intended third-party beneficiary of this Section , with the right to enforce its provisions.

For any instance running Microsoft Software (each, a “Microsoft Instance”), you may not use nesting, container, or similar technologies to sell or resell multiple instances, portions of an instance, or containers running within the Microsoft Instance, unless (a) you are the ultimate end user of the Microsoft Instance, (b) you have supplemented the Microsoft Instance with your own applications, or (c) you have added primary and significant functionality to the Microsoft Instance.

In conjunction with the Services, you may be allowed to use certain software (including related support, maintenance, and documentation) developed, owned, or provided by third parties or their licensors. Use of third party software is subject to these additional terms and conditions:

  • By using NVIDIA Corporation’s GRID Software, you agree to be bound by the terms and conditions of the NVIDIA GRID Cloud End User License Agreement.
  • By using NVIDIA Corporation’s Tesla Driver, CUDA Toolkit, cuDNN, NVENC, NVCUVID, NVM:, nvidia-smi, and NCCL Library Software, toolkits, and drivers, you agree to be bound by the terms and conditions of the NVIDIA Cloud End User License Agreement and NVIDIA Third Party Materials Notices.
  • By using Red Hat, Inc.’s software, you agree to be bound by the terms and conditions of the Red Hat Cloud Software Subscription Agreement. Red Hat also disclaims any (i) warranties with respect to Red Hat, Inc. software; and (ii) liability for any damages, whether direct, indirect, incidental, special, punitive or consequential, and any loss of profits, revenue, data or data use, arising from use of Red Hat, Inc. software.
  • By using SUSE LLC’s software, you agree to be bound by the terms and conditions of the SUSE End User License Agreement and the SUSE Terms and Conditions.

Unless you specify a termination date, your Spot Instance request will remain active until the earlier of the following: (1) seven days have passed, (2) we fulfill it, or (3) you cancel it. We may terminate, stop, or hibernate Spot Instances at any time and without any notice to you if the current price for the applicable Spot Instance (the “Spot Price”) equals or exceeds the price you specified you were willing to pay for the Spot Instance (“Your Maximum Price”). Spot Instances purchased for a fixed duration (“Spot Blocks”) will not be terminated because the Spot Price equals or exceeds Your Maximum Price (if specified), but will terminate at the conclusion of the fixed duration. Spot Instances and Spot Blocks may also be terminated for AWS capacity requirements. If a Spot Block is terminated due to AWS capacity requirements, you will not be charged for that Spot Block. Spot Instances may not be used with certain Services, features, and third-party software we specify, including IBM software packages or Microsoft SQL Server. You may not, directly, indirectly, alone, or in cooperation with any third party, attempt to control, influence, or manipulate the price for Spot Instances. You may not submit requests for Spot Instances through any third party (e.g., “proxy bidding”) or share information with any third party regarding Your Maximum Price specified in your Spot Instance Requests.

EC2 Reserved Instances and Dedicated Hosts.

 We may change Savings Plans, EC2 Reserved Instance and EC2 Dedicated Host Reservation pricing at any time, but price changes will not apply to previously designated Savings Plans, EC2 Reserved Instances or EC2 Dedicated Host Reservations, except as described in this Section If Microsoft increases the license fees it charges for Windows, or if Red Hat increases the license fees it charges for Red Hat Enterprise Linux (“RHEL”), we may make a corresponding increase to the per-hour usage rate (or institute a corresponding per-hour usage rate) for Savings Plans for, or EC2 Reserved Instances with, Windows or RHEL. Any increase in (or institution of) the per-hour usage rate for Savings Plans for, or EC2 Reserved Instances with, Windows will be made between December 1 and January 31, and we will provide 30 days’ notice. For any increase in (or institution of) the per-hour usage rate for Savings Plans for, or EC2 Reserved Instances with, RHEL, we will provide 30 days’ advance notice. If this happens, you may: (a) continue to use your EC2 Reserved Instances with Windows or RHEL with the new per-hour usage price; (b) convert your EC2 Reserved Instances with Windows or RHEL to comparable EC2 Reserved Instances with Linux; or (c) terminate your EC2 Reserved Instances with Windows or RHEL and receive a pro rata refund of the up-front fee you paid for the terminated EC2 Reserved Instances with Windows or RHEL.

 We may terminate the Savings Plans, EC2 Reserved Instance or EC2 Dedicated Host Reservation pricing programs at any time. Savings Plans and EC2 Dedicated Hosts are nontransferable, and EC2 Reserved Instances are only transferrable in accordance with the requirements of the RI Marketplace provided on the AWS Site. Scheduled Instances and Convertible Reserved Instances are not eligible for the RI Marketplace. Savings Plans, EC2 Reserved Instances and EC2 Dedicated Host Reservations are noncancellable, and EC2 Dedicated Hosts associated with an active EC2 Dedicated Host Reservation cannot be removed from your account, so you will be charged for the duration of the term you selected, even if you terminate the Agreement. All amounts paid in connection with Savings Plans, EC2 Reserved Instances and EC2 Dedicated Host Reservations are nonrefundable, except that if we terminate the Agreement other than for cause, terminate an individual EC2 Reserved Instance or EC2 Dedicated Host Reservation type, or terminate the Savings Plans, EC2 Reserved Instance or EC2 Dedicated Host pricing program(s), we will refund you a pro rata portion of any up-front fee paid in connection with any previously designated Savings Plans, EC2 Reserved Instances or EC2 Dedicated Hosts. You may not purchase EC2 Reserved Instances for the purpose of reselling them in the RI Marketplace, and we reserve the right to refuse or cancel your purchase if we suspect you are doing so. Upon expiration or termination of the term of Savings Plans, EC2 Reserved Instances or EC2 Dedicated Host Reservations, the reserved pricing will expire and standard on-demand usage prices will apply. You are responsible for determining if you are subject to any limitations arising from the purchase or Savings Plans, EC2 Reserved Instances or EC2 Dedicated Host Reservations. For example, you are responsible for complying with any applicable laws, policies, terms or conditions governing your payment of up-front fees or the expiration of reserved resources, including any fiscal or appropriation laws, or other policies or restrictions governing up-front payments for goods or services. 

EC2 Reserved Instance (RI) Marketplace.

 The rights to an active EC2 Reserved Instance can be offered for sale through the RI Marketplace as long as (1) the remaining term on the Reserved Instance is greater than 1 month and (2) your payment of the upfront charge for it has been received and processed (for credit card purchases, 30 days after you have paid the upfront fee, and for invoice purchases, after you have paid the applicable invoice) (a “Marketable EC2 Reserved Instance”). You can be a “Seller” if you are a current AWS customer in good standing, you have a Marketable EC2 Reserved Instance associated with your AWS account, and you complete the registration process through your AWS account. You can be a “Buyer” if you are a current AWS customer in good standing. Non-U.S.-based entities may not be Sellers without providing the Form W-8BEN (Certificate of Foreign Status of Beneficial Owner for United States Tax Withholding) to establish that you are not a U.S. person. You can resell an EC2 Reserved Instance that you previously purchased through the RI Marketplace. You may not resell an EC2 Reserved Instance that you purchased through a discount program (Reserved Instance Volume Discounts or otherwise) without obtaining our prior approval.

As a Seller, you will be the seller of record of your rights to a Marketable EC2 Reserved Instance. Except as expressly set forth in these Service Terms, we are not involved in any underlying transaction between you and any Buyer. We or our affiliates may also participate in the RI Marketplace as a Seller or a Buyer. We may remove any Marketable EC2 Reserved Instance from the RI Marketplace at any time. Once sold and transferred to a Buyer, a Seller will have no rights to that Marketable EC2 Reserved Instance.

 On Seller’s behalf, we will process all payments for Transactions and collect the applicable Transaction Proceeds. “Transaction” means any sale of a Marketable EC2 Reserved Instance through the RI Marketplace. “Transaction Proceeds” means the gross sales proceeds received by us from any Transaction. You will ensure that all fees and charges payable by Buyers for Marketable EC2 Reserved Instance are billed and collected through us and you will not offer or establish any alternative means of payment. We may impose transaction limits on some or all Buyers and Sellers relating to the value of any Transaction or disbursement, the cumulative value of all Transactions or disbursements during a period of time, or the number of Transactions that we will process over a period of time. We may withhold for investigation, or refuse to process, any Transaction that we suspect is fraudulent, unlawful, or otherwise violates these Service Terms, the Agreement, or the Acceptable Use Policy. For each Transaction, we will not remit Transaction Proceeds to a Seller, and the Marketable EC2 Reserved Instance will not be available to the Buyer, until after we have successfully processed payments for that Transaction from the Buyer.

You will not receive any funds collected from payments associated with the hourly prices of your Marketable EC2 Reserved Instance. At the end of each business day, we will pay to you all due and payable Transaction Proceeds that we have collected as of the date that is 2 business days prior to that date. We will deduct from each payment any applicable fees and charges due to us related to Marketable EC2 Reserved Instances. We may withhold, deduct, or setoff any amounts payable by you to us or our affiliates against any Transaction Proceeds. Payments will be made only to an ACH-enabled bank account located in the United States that you register with us. If there is an error in the processing of any Transaction, you authorize us to initiate debit or credit entries to your designated bank account, to correct such error, provided that any such correction is made in accordance with applicable laws and regulations. If we are unable to debit your designated bank account for any reason, you authorize us to resubmit the debit, plus any applicable fees, to any other bank account or payment instrument that you have on file with us or to deduct the debit and applicable fees from future Transaction Proceeds.

 Sellers are responsible for the calculation, validation, and payment of any and all sales, use, excise, import, export, value added, withholding, and other taxes and duties assessed, incurred, or required to be collected or paid (“Taxes”) for any reason in connection with any Transaction and with any Marketable EC2 Reserved Instance. We are not responsible for determining whether any Taxes apply to any Transaction or remitting Taxes to any taxing authority with respect to any Transaction, or for reporting any information (including the payment of Taxes) with respect to any Transaction. Each Seller will indemnify us and our affiliates against any claim or demand for payment of any Taxes imposed in connection with any Transaction, and for any fines, penalties, or similar charges imposed as a result of the Seller’s failure to collect, remit, or report any Taxes in connection with any Transaction.

For each Seller, we will collect the necessary data and tax forms to enable compliance with applicable tax laws. For example, for U.S.-based Sellers, we will collect and retain Seller name and address, and may collect the tax identification number and other data as needed to comply with Form K reporting requirements; for non-U.S.-based Sellers, we will collect and retain a Form W-8BEN tax form (which includes name, address, and a signature) as proof that you are exempt from Form K reporting. For each Buyer, we will collect and retain the Buyer’s name and address. Buyers and Sellers will not know the name of the other party to the Transaction until the Transaction is completed. Upon completion of the Transaction, we will share the applicable Buyer’s city, state, and zip with the Seller so that the Seller can calculate the appropriate tax (if any) to remit to the appropriate government entity. We will share the Seller’s legal name on the Buyer’s invoice. Buyers and Sellers may not use information about the Transaction or about the other party gained in connection with a Transaction (“Transaction Information”) for any purpose that is not related to the Transaction. For example, you may not, directly or indirectly: (1) disclose any Transaction Information to any third party, except as necessary for you to perform your tax obligations or other obligations under these Service Terms and only if you ensure that every recipient uses the information only for that purpose and complies with these restrictions; (2) use any Transaction Information for any marketing or promotional purposes whatsoever; (3) use any Transaction Information in any way inconsistent with applicable law; (4) contact a party to influence them to make an alternative sale or purchase; or (5) target communications of any kind on the basis of the intended recipient being an RI Marketplace Buyer or Seller.

Amazon EC2 enables you to provision Amazon EC2 instances using your Microsoft Software and Microsoft Licenses (the “BYOL Program”). Unless otherwise specified in your agreement(s) with Microsoft, you can participate in the BYOL Program only if you comply with the requirements here, and you (a) use Dedicated Instances or Dedicated Hosts; and (b) launch from Virtual Machines (VMs) sourced from software binaries provided by you.

You must be eligible to use the BYOL Program for the applicable Microsoft Software under your agreements with Microsoft. You are solely responsible for obtaining all required licenses and for complying with all applicable Microsoft licensing requirements, including the Product Use Rights/Product Terms. By using the Microsoft Software under the BYOL Program, you agree to Microsoft's End User License Agreement.

You agree that you have determined that your use of the BYOL Program will comply with the applicable Microsoft licensing requirements. Usage of the Services in violation of your agreement(s) with Microsoft is not authorized or permitted.

As part of using Amazon EC2, you agree that your Amazon EC2 resources may be terminated or replaced due to failure, retirement or other AWS requirements. THE USE OF AMAZON EC2 DOES NOT GRANT YOU, AND YOU HEREBY WAIVE, ANY RIGHT OF PHYSICAL ACCESS TO, OR PHYSICAL POSSESSION OF, ANY AWS SERVERS, EQUIPMENT, REAL OR PERSONAL PROPERTY, OR OTHER ASSETS.

6. Alexa Web Services

You may use data you receive from the Alexa Services Web Information Service and Alexa Top Sites (collectively “Alexa Web Services”), such as web site traffic data, to enhance your application or website, but may not use it in any application whose primary purpose is to display the same or related data or to compete with cromwellpsi.com You may not display data you receive via the Alexa Web Services that has been cached for more than 24 hours. You may not resell or redistribute the Alexa Web Services or data you access via the Alexa Web Services.

7. Amazon SimpleDB Service (Amazon SimpleDB)

If during the previous 6 months you have incurred no fees for Amazon SimpleDB and have registered no usage of Your Content stored in Amazon SimpleDB, we may delete Your Content that is stored in Simple DB upon 30 days prior notice to you.

8. Amazon CloudWatch and Autoscaling

Amazon CloudWatch collects and stores certain information for the Services you are monitoring, including CPU utilization, data transfer, and disk usage and activity (collectively, “CloudWatch Metric Data”). CloudWatch Metric Data may be used by AWS to maintain and provide the Services (including development and improvement of the Services).

9. AWS Import/Export Disk, AWS Snowball, AWS Snowcone and AWS Snowmobile

“AWS Import/Export” includes: AWS Import/Export Disk, AWS Snowball, AWS Snowcone and AWS Snowmobile.

We may return physical storage that you send to us in connection with your use of AWS Import/Export Disk (“Media”) to you for any reason. Media shipped to us for import into or export from supported AWS Services in the EU (Ireland) Region must originate from and be returned to an address within the European Union or the European Economic Area. We may refuse, return, or dispose of Media that is damaged, defective, unreadable, or not shipped via Amazon-approved means in accordance with the Documentation (collectively, “Unsuitable Media”). We may erase any data on such Unsuitable Media. If you request and we return Unsuitable Media to you, you agree that we will select the shipping carrier and handling standards for return of such Unsuitable Media, and the carrier and standards may not be the same as (and may cost more than) those we use for shipping media in connection with AWS Import/Export Disk generally. You will reimburse us for any expenses we incur in connection with any Unsuitable Media. If we are unable to return Media to you due to any issue with your address or Media, we will attempt to notify you, and you will have 30 days from the date we provide notification to resolve the issue. If the issue is not resolved, the Media will be deemed Unsuitable Media.

As part of AWS Snowball and AWS Snowcone, we will ship you an agreed upon number of “Snowball” or "Snowcone" hardware appliances (each an “Appliance”) and provide you with access to the applicable AWS Snowball Client or AWS Snowcone client software (together with the software contained on the Appliance, and any updates or upgrades to the foregoing, the “Appliance Software”). You agree that you will not allow any Appliance to leave the country to which the Appliance is shipped until you provide it (in the same country) to a carrier for redelivery to us. Upon our request for any reason, you will promptly return any appliance to us. Appliances collect and provide us with metrics regarding the use of Appliances, including boot times, size of transferred files, duration of transfers, and errors or timeouts. These metrics may be associated with your account ID, and we may use these metrics to maintain and provide the Services (including development and improvement of the Services).

As part of AWS Snowmobile, we will transport a containerized data center and networking equipment (collectively, “Snowmobile”), and other materials, equipment, and software necessary for operation of the Snowmobile (collectively with the Snowmobile, the “Snowmobile Materials”). You will ensure that, at all times, the designated transfer location for delivery of the Snowmobile Materials (the “Transfer Site") meets the minimum requirements necessary to support the delivery, setup, maintenance, use, and removal of the Snowmobile Materials as described on the AWS Site and otherwise as described in the Snowmobile Documentation or provided to you during the ordering and delivery process. You will ensure that you have all necessary rights, certifications, and licenses for the delivery, setup, maintenance, use, and removal of the Snowmobile Materials at the Transfer Site. You are responsible for any damage to the Snowmobile Materials while at the Transfer Site, unless caused by AWS. You may not allow Snowmobile Materials to leave the Transfer Site other than under the supervision of personnel designated by AWS. You will give personnel designated by AWS prompt and reasonable access to the Transfer Site as necessary to deliver, setup, inspect, maintain, and remove the Snowmobile Materials. You will not require AWS personnel to sign, accept, or otherwise agree to any documentation as a condition of accessing the Transfer Site, and you agree that the terms of any such documentation are void even if signed by AWS personnel. You will ensure that no one accesses, moves, or repairs the Snowmobile Materials other than (i) personnel designated by AWS, (ii) as permitted in writing by AWS in connection with the maintenance of Snowmobile Materials, or (iii) as necessary due to a situation involving imminent injury, damage to property, or an active fire alarm system. AWS may terminate your use of Snowmobile Materials and remove the Snowmobile Materials if you breach these terms or the terms of the Agreement with respect to Snowmobile Materials.

Once AWS Import/Export services are complete, we will return the Media to you, and delete data from the Appliances or Snowmobiles, as applicable.

You are responsible for payment of all customs, duties, taxes, and other charges in connection with Media and Appliances being shipped to or from us.

For AWS Import/Export Disk, you will bear the entire risk of loss of, or damage to, any Media while in transit. For AWS Snowball and AWS Snowcone, you are responsible for any damage to, or loss of, an Appliance after delivery to you until the carrier accepts the Appliance for delivery back to us. In addition to other rights and remedies we may have under the Agreement, we may charge you the applicable lost device fee specified on the AWS Snowball or AWS Snowcone pricing pages if: (a) an Appliance is lost or irreparably damaged after it has been provided to you until the carrier accepts the Appliance for delivery back to us; or (b) unless otherwise contemplated by the Documentation or agreed by us, you do not provide the Appliance to the carrier for return to us within 90 days of the date it was delivered to you.

 YOU ARE SOLELY RESPONSIBLE FOR APPLYING APPROPRIATE SECURITY MEASURES TO YOUR DATA AND YOUR USE OF MEDIA, APPLIANCES AND SNOWMOBILE MATERIALS, INCLUDING ENCRYPTING SENSITIVE DATA AND NOT ALLOWING UNAUTHORIZED ACCESS TO ANY MEDIA, APPLIANCE OR SNOWMOBILE MATERIALS.

AWS or its affiliates maintain all rights in the Appliances, Appliance Software, and Snowmobile Materials and is not selling, renting, leasing, or transferring any ownership, intellectual or other rights in the Appliances, Appliance Software, or Snowmobile Materials to you. You will not, and will not purport to, assign, grant, or transfer the Appliances, Appliance Software, or Snowmobile Materials or any interest in the Appliances, Appliance Software, or Snowmobile Materials to any individual or entity, and any such purported assignment, grant or transfer is void. Without limiting the foregoing, you will not (or attempt to), and will not permit or authorize third parties to (or attempt to), (a) scan, x-ray, open, modify, alter, disassemble, or otherwise attempt to view the inside of or tamper with the Appliance or Snowmobile Materials; or (b) circumvent or disable any features or measures in the Appliance, Appliance Software, or Snowmobile Materials. You acknowledge that the Appliances and Snowmobile Materials may be equipped with tamper monitoring.

You will return all Appliances to us for assessment and to enable us to determine how they can be reused and which components must be recycled in an environmentally sound manner, regardless of the external condition of the Appliance and even if you believe the Appliance may be damaged or non-functional. You will not, under any circumstance, treat or dispose of an Appliance (or any component thereof, including internal batteries) as waste. Shipments of used Appliances must be conducted in a manner consistent with applicable laws relating to used electronic equipment, including where applicable the Basel Convention Technical Guidelines on Transboundary Movement of Used Electrical and Electronic Equipment.

You are responsible for complying with all applicable data protection, import, re-import, export, and re-export control laws, including any applicable license requirements, and country-specific sanctions programs. You are responsible for serving as the exporter and importer of record (as applicable) for your Media, data, software, or technology, and you accept that AWS will not participate in the export or import procedure. If you are using Appliances, Media, Appliance Software, or Snowmobile Materials for dual use items in the European Union, you represent that you, or the legal entity you represent, are “established” in the European Union; or, if you are not “established” in the European Union, that you will not upload, request that we download, or export such dual-use items outside the European Union. If you are using Appliances, Media, Appliance Software, or Snowmobile Materials in the European Union for military items, you represent that you, or the legal entity you represent, are permitted by the Member State of your incorporation to upload, request that we download or export any such military items from that Member State, and it is a condition of this Agreement and your use of AWS Import/Export that you are so permitted.

Amazon Relational Database Service (Amazon RDS)

 You may store snapshots of Your Amazon RDS Content for later use in Amazon RDS, but snapshots cannot be downloaded outside the Services.

 The Reserved DB Instance program allows you to designate Amazon RDS database instances as subject to the reserved pricing and payment terms set forth on the Amazon RDS detail page on the AWS Site (each designated instance, a “Reserved DB Instance”). We may terminate the Reserved DB Instance program at any time. We may change pricing for the Reserved DB Instance program at any time, but price changes will not apply to previously designated Reserved DB Instances. Reserved DB Instances are noncancellable, and you will owe the amount charged for the Reserved DB Instance for the duration of the term you selected, even if the Agreement is terminated. Reserved DB Instances are nontransferable and all amounts paid in connection with the Reserved DB Instances are nonrefundable, except that if we terminate the Agreement other than for cause, terminate an individual Reserved DB Instance type, or terminate the Reserved DB Instance program, we will refund you a pro rata portion of any up-front fee paid in connection with any previously designated Reserved DB Instances. Upon expiration or termination of the term of a Reserved DB Instance, the Reserved DB Instance pricing will expire and standard on-demand usage prices will apply to the database instance.

Using Oracle Software.

“License Included”. As part of the Services, you may be allowed to use certain software (including related documentation) described on the AWS Site developed and owned by Oracle America, Inc. or its affiliates (“Oracle”) and Oracle’s licensors (collectively, the “Oracle Software”). If you choose to use the Oracle Software and do not already have a license from Oracle for that Oracle Software, Oracle and its licensors require that you agree to these additional terms and conditions:

  • Oracle or its licensors retains all ownership and intellectual property rights in the Oracle Software, and title to the Oracle Software does not transfer to you or any third party by virtue of this Agreement.
  • The Oracle Software is subject to a restricted license and may only be used in connection with the Services, and only by the individual or legal entity that entered into the Agreement.
  • You may only use the Oracle Software for your internal business operations and in accordance with the Agreement. You may permit agents or contractors (including outsourcers) to use the Oracle Software on your behalf for the purposes set forth in, and subject to, the Agreement, provided you are responsible for the agent’s, contractor’s and outsourcer’s compliance with the Agreement in connection with such use.
  • You may not:
    • assign, grant, or transfer the Oracle Software or any interest in the Oracle Software to another individual or entity, and if you purport to grant a security interest in the Oracle Software, the secured party will have no right to use or transfer the Oracle Software;
    • use the Oracle Software for rental, timesharing, subscription services, hosting, or outsourcing;
    • remove or modify any notice of Oracle’s or its licensors’ proprietary rights;
    • make the Oracle Software available in any manner to any third party for use in the third party’s business operations;
    • duplicate, reverse engineer (unless required by law for interoperability), disassemble or decompile the Oracle Software (including by reviewing data structures or similar materials produced by the Oracle Software); or
    • publish any results of benchmark tests run on the Oracle Software.
  • Third party technology that may be appropriate or necessary for use with some Oracle Software is specified in the related documentation, and that third party technology is licensed to you only for use with the Services and under the terms of the third party license agreement specified in the documentation, not this Agreement.
  • To the extent permitted by applicable law, Oracle disclaims any liability for any damages, whether direct, indirect, incidental, special, punitive or consequential, and any loss of profits, revenue, data or data use, arising from your use of the Oracle Software.
  • Notwithstanding anything to the contrary elsewhere in the Agreement, Oracle is an intended third party beneficiary of the Agreement, but solely with respect to this Section of these Service Terms.
  • The Uniform Computer Information Transactions Act does not apply to your use of the Oracle Software.
  • Upon any termination of the Agreement, you must discontinue use of the Oracle Software and any related documentation.

“Bring-Your-Own-License” (BYOL). Under the BYOL option, Amazon RDS enables you to provision Oracle Software to Amazon EC2 instances and use the management capabilities of Amazon RDS for the Oracle Software. You can use the Oracle Software with Amazon RDS if you meet the following conditions:

  • You must have a valid license with “Software Update License & Support” for the Oracle Software you wish to run. The terms of your existing license and support agreement(s) with Oracle continue to apply to your use of the Oracle Software; and
  • You must follow Oracle’s current policies for licensing Oracle Database software in the cloud computing environment. The database instances using the Oracle Software with Amazon RDS reside in the Amazon EC2 environment.

Using Microsoft Software. “License Included.” Use of Microsoft Software on Amazon RDS is subject to Section above and these additional terms and conditions:

  • SQL Server Web Edition may be used only to support public and Internet accessible Web pages, Web sites, Web applications, or Web services. It may not be used to support line of business applications (e.g., Customer Relationship Management, Enterprise Resource Management, and other similar applications).
  • Microsoft is an intended third-party beneficiary of this Section , with the right to enforce its provisions.

Amazon Simple Notification Service (Amazon SNS)

 Amazon SNS from the Asia Pacific (Tokyo) Region is sold and provided by AMCS LLC, an affiliate of AWS, and not AWS, but is otherwise subject to the terms of the Agreement.

Amazon SNS from the Asia Pacific (Singapore) Region is sold and provided by AMCS SG PRIVATE LIMITED (“AMCS SG”), an affiliate of AWS, and not AWS, but is otherwise subject to the terms of the Agreement.

Fees for Amazon SNS will apply regardless of whether delivery of your notifications is prevented, delayed, or blocked due to reasons outside of our control.

You may not use Amazon SNS to send SMS messages that include Premium Content (as defined in the Mobile Marketing Association Guidelines). You may not charge recipients for receiving Amazon SNS notifications by SMS unless you have obtained the recipient’s express consent. You must advise recipients receiving Amazon SNS notification by SMS that telecommunications providers may charge the recipient to receive Amazon SNS notifications by SMS. You are responsible for ensuring you have all necessary terms in place with push notification service providers, including terms necessary to comply with data protection laws.

You must obtain our prior written consent before using Amazon SNS to send SMS messages for:

  • financial transactions or payment services (e.g., mobile banking, bill presentment, bill payment, money transfer, peer-to-peer payment or lending credit, debit or stored value payment services);
  • charitable programs (e.g., soliciting donations for a non-profit organization);
  • sweepstakes or contests;
  • advertisements or promotions for commercial products, goods, or services; or
  • location-based services (e.g., where a recipient receives messages based on the geographical location of the recipient’s wireless device).

We may change, discontinue, or deprecate support for a third party push notification platform at any time.

Through your use of Amazon SNS you will not:

  • Transmit any material that contains viruses, Trojan horses, worms, or any other malicious or harmful programs.
  • Offer or purport to offer any Emergency Services. “Emergency Services” means services that allow a user to connect with emergency services personnel or public safety answering points, such as or E services.
  • Materially violate or facilitate the material violation of any local or foreign law, rule, regulation, or order, including laws regarding the transmission of data or software.
  • Transmit material that is sexually explicit, relates to “adult services”, or contains sensitive financial or identifying information (such as social security numbers)
  • Resell, sublicense, or timeshare the Services, or use them on behalf of anonymous or other third parties.
  • Use the Services in hazardous environments (such as operation of nuclear facilities, aircraft navigation, or any other use that may result in foreseeable risk of injury, death, or destruction of property).

AWS Identity and Access Management (IAM)

 We may change user credentials created by you using IAM if we determine in our reasonable discretion that a change is necessary for the protection of your AWS account and resources, and we will promptly notify you of any such change.

We may change, discontinue, or deprecate support for any third-party identity provider at any time without prior notice.

Amazon Route 53

You may not create a hosted zone for a domain that you do not own or have authority over.

All Domain Name System (DNS) records (other than Private DNS records) used in connection with Amazon Route 53 will be publicly available, and AWS will have no liability for disclosure of those DNS records.

Domain name registration services are provided under the Amazon Route 53 Domain Name Registration Agreement.

AWS Elastic Beanstalk

AWS may reject or modify any URL used in connection with an AWS Elastic Beanstalk environment that violates the intellectual property rights any third-party or violates the Acceptable Use Policy.

If you stop running your AWS Elastic Beanstalk environment at any time, the [myapp] portion of the URL used in connection with the environment will no longer be available to you and may be used by another AWS customer.

Amazon Simple Email Service (SES)

Amazon SES from the Asia Pacific (Singapore) Region is sold and provided by AMCS SG PRIVATE LIMITED (“AMCS SG”), an affiliate of AWS, and not AWS, but is otherwise subject to the terms of the Agreement.

Amazon SES from the Asia Pacific (Tokyo) Region is sold and provided by AMCS LLC (“AMCS”), an affiliate of AWS, and not AWS, but is otherwise subject to the terms of the Agreement.

Like many email service providers, to increase the security and reliability of email you send, attempt to send, or receive using SES (“SES Email”), we (or our third-party providers) may store and scan your SES Email and Your Content included in SES Email to protect you and SES by preventing and blocking “spam” e-mails, viruses and spyware, and other harmful or unwanted items from being sent and received over SES.

We may suspend or terminate your access to SES, or block or decline to send or receive any SES Email, if we determine that:

  • our scan of SES Email or Your Content included in SES Email reveals abusive or low quality email (such as “spam”),
  • SES Email bounces back to us or we receive abuse complaints (including complaints from third parties) in connection with your SES Email, or
  • the source or ReturnPath email address you have provided us for “address bounces” or complaints is not successfully receiving email.

If your SES Emails are blocked, delayed, or prevented from delivery by reasons outside of our control, your payment obligations continue.

 AWS is not the “sender” as defined in the CAN-SPAM Act or similar applicable law.

AWS Direct Connect

You are responsible for protecting your AWS Direct Connect connections, including using physical security, firewalls, and other network security tools as appropriate.

AWS will permit data center operators or other service providers to connect your hardware to AWS’s hardware at the AWS Direct Connect location(s) that you select. AWS will provide the necessary information to enable the data center operator or other service provider to establish and monitor this connection, including your name, email address, network configuration, activity information, and AWS account number.

You are responsible for your separate relationship with the data center operator or other service provider, including compliance with your agreement with, and the policies and procedures of, the data center operator or other service provider, and payment of applicable fees to the data center operator or other service provider. You are responsible for providing or procuring (and AWS will not own or be responsible for) any equipment or cabling necessary to establish this dedicated connection.

If the connection you establish as part of AWS Direct Connect is temporarily unavailable or terminated, AWS will route traffic bound for your AWS resources over the public Internet and AWS’s standard data transfer charges will apply. However, if you are using Amazon Virtual Private Cloud (VPC), traffic bound for your Amazon VPC resources will be routed through an IPsec VPN connection. If an IPsec VPN connection is unavailable, traffic bound for your Amazon VPC resources will not be delivered.

Amazon ElastiCache

You may not access or tamper with any software we install on the cache nodes as part of Amazon ElastiCache.

The Reserved Cache Node program allows you to purchase reserved Amazon ElastiCache cache nodes subject to the reserved pricing and payment terms set forth on the Amazon ElastiCache detail page on the AWS Site (each designated instance, a “Reserved Cache Node”). We may terminate the Reserved Cache Node program at any time. We may change the pricing for Reserved Cache Nodes at any time, but price changes will not apply to previously designated Reserved Cache Nodes. Reserved Cache Nodes are nontransferable, and all amounts paid in connection with Reserved Cache Nodes are nonrefundable, except that if we terminate the Agreement other than for cause, terminate an individual Reserved Cache Node type, or terminate the Reserved Cache Node program, we will refund you a pro rata portion of any up-front fee paid in connection with any previously designated Reserved Cache Nodes. Upon expiration or termination of the term of a Reserved Cache Node, standard on-demand usage prices will apply to the cache nodes you use.

AWS GovCloud (US) Service Terms

Use of the Services in the AWS GovCloud (US) Regions is subject to the AWS GovCloud (US) Terms and Conditions available via AWS Artifact in the AWS GovCloud (US) management console.

You are responsible for satisfying any applicable eligibility requirements for using the AWS GovCloud (US) Regions, including providing accurate and current registration information. We may make, directly or through third parties, any inquiries we consider necessary to validate information that you provide to us, including checking commercial and governmental databases. While we may take steps to verify the identity of our Customers, we cannot and do not guarantee any Customer's identity.

AWS makes no representation or warranty related to the US Persons status of any Customer or End User that may be granted access to the AWS GovCloud (US) Regions.

You are responsible for verifying the adequacy of the AWS GovCloud (US) Regions for the processing and storage of Your Content and that your use of AWS Services will comply with the laws and regulations that may govern Your Content.

Amazon DynamoDB

The Amazon DynamoDB Reserved Capacity program allows you to purchase reserved throughput capacity (reads and writes) subject to the pricing and payment terms set forth on the Amazon DynamoDB detail page on the AWS Site (“Amazon DynamoDB Reserved Capacity”). We may terminate the Amazon DynamoDB Reserved Capacity program at any time. We may change the pricing for Amazon DynamoDB Reserved Capacity at any time, but price changes will not apply to previously purchased Amazon DynamoDB Reserved Capacity. Amazon DynamoDB Reserved Capacity is nontransferable and all amounts paid in connection with the Amazon DynamoDB Reserved Capacity are nonrefundable, except that if we terminate the Agreement (other than for cause) or the Amazon DynamoDB Reserved Capacity program, we will refund you a pro rata portion of any up-front fee paid in connection with any previously purchased Amazon DynamoDB Reserved Capacity. Upon expiration or termination of the term of any Amazon DynamoDB Reserved Capacity, standard on-demand usage prices will apply to your use of Amazon DynamoDB.

Your use of DynamoDB Local is governed by the Amazon DynamoDB Local License Agreement.

AWS Marketplace

Except to the extent Content made available through AWS Marketplace is provided to you under a separate license that expressly states otherwise, neither you nor any End User may, or may attempt to, (a) modify, alter, tamper with, repair, or otherwise create derivative works of any Content, (b) reverse engineer, disassemble, or decompile the Content or apply any other process or procedure to derive the source code of any software included in the Content, (c) resell or sublicense the Content, (d) transfer Content outside the Services without specific authorization to do so, or (e) tamper with or circumvent any controls or make unauthorized copies of the Content.

AWS may stop providing AWS Marketplace (or any features of or listings within AWS Marketplace), without prior notice to you. In addition, AWS may disable or remove Content you have purchased on AWS Marketplace, if AWS determines that the Content may violate any Policies or any other regulations, policies, or laws.

 To the extent authorized by the respective third party provider on AWS Marketplace, AWS may disable access to or remove any Third Party Content you purchased or subscribed to on AWS Marketplace in the event of overdue and uncollected payments, upon AWS providing you with at least 30 days’ advance written notice.

AWS Data Pipeline

Amazon Elastic Transcoder

The distribution of files created by Amazon Elastic Transcoder may require that you obtain license rights from third parties, including owners or licensors of certain third party audio and video formats. You are solely responsible for obtaining these licenses and paying any necessary royalties or fees.

AWS OpsWorks

AWS CloudHSM

In conjunction with your use of AWS CloudHSM, you may be allowed to use certain software (including related documentation) developed and owned by SafeNet, Inc. or its licensors (collectively, the “SafeNet Software”). If you use the SafeNet Software, you agree to the additional terms and conditions located here.

Amazon AppStream

NVIDIA Software. If your application uses the NVIDIA graphics processing unit (GPU) on an Amazon AppStream instance, you agree to be bound by the terms and conditions of the NVIDIA Cloud End User License Agreement.

If you use the Amazon AppStream User Pool feature to enable End Users to access applications, you agree that we may store and process these End Users’ email addresses in AWS Regions outside the AWS Regions where you are using Amazon AppStream We will only use these email addresses to send the End Users email notifications to enable them to access Amazon AppStream

Amazon WorkSpaces

Any Content that you or any End User run on, cause to interface with, or upload to your WorkSpaces is Your Content. You are responsible for maintaining licenses and adhering to the license terms of any of Your Content on your WorkSpaces.

Use of Microsoft Software on Amazon WorkSpaces is subject to Section above. Microsoft is an intended third-party beneficiary of this Section , with the right to enforce its provisions.

Amazon WorkSpaces is designed to serve as a cloud desktop service. WorkSpaces may not be used to accept inbound network connections, as server instances, or to serve web traffic or your network traffic, and you may not reconfigure the inbound network connections of your WorkSpaces.

You and End Users may only use the WorkSpaces client software on computer equipment owned or controlled by you or your End Users. Your use of the WorkSpaces client software is governed by the Amazon WorkSpaces Application License Agreement.

To perform configurations, health checks, and diagnostics on Amazon WorkSpaces, we may collect and use performance and log information tied to the operation and management of the Service.

Software installed by us on your WorkSpaces may connect to a license activation server hosted by AWS. You may not attempt to prevent any license activation function.

As part of regular operation of Amazon WorkSpaces, WorkSpaces may be updated with operating system and software upgrades, patches, and bug fixes. During these updates, only software, documents, and settings that are part of the operating system image used for the WorkSpace or part of a user’s profile (D: drive in the WorkSpace) will persist.

Microsoft BYOL Licensing. Under this option, Amazon WorkSpaces enables you to provision WorkSpaces using your Microsoft Software and Microsoft Licenses (the “WorkSpaces BYOL Program”). You must be eligible to use the WorkSpaces BYOL Program for the applicable Microsoft software under your agreement(s) with Microsoft. You are solely responsible for obtaining all required licenses and for complying with all applicable Microsoft licensing requirements, including the Product Use Rights/Product Terms. Further, you must have accepted Microsoft's End User License Agreement (Microsoft EULA), and by using Microsoft Software under the WorkSpaces BYOL Program, you agree to the Microsoft EULA. You agree that you have determined that your use of the WorkSpaces BYOL Program will comply with the applicable Microsoft licensing requirements. Usage of the Services in violation of your agreement(s) with Microsoft is not authorized or permitted.

Amazon Cognito

We may change, discontinue, or deprecate support for any third-party identity provider at any time without prior notice.

In the event a particular Cognito User Pool has no active users within a 12 month period, we may delete the Cognito User Pool upon 30 days’ prior notice to you.

Amazon WorkDocs

Amazon WorkDocs from the Asia Pacific (Tokyo) Region is sold and provided by AMCS LLC, an affiliate of AWS, and not AWS, but is otherwise subject to the terms of the Agreement.

We may delete any of your End Users’ Content uploaded to Amazon WorkDocs if the End User is marked “Inactive” in the Amazon WorkDocs’ Administrator Dashboard and you have not been billed for more than 30 days for this End User’s usage. We may also delete your Amazon WorkDocs site and Your Content when you have no End Users marked “Active” within the Amazon WorkDocs Administrator Dashboard for more than 30 days.

If no End User accounts associated with your AWS account have registered any usage of the Services for several months, then we may delete the inactive End Users’ accounts after providing 30 days’ notice.

Your use of the Amazon WorkDocs Sync Software is governed by the Amazon WorkDocs Sync License Agreement.

Your use of the Amazon WorkDocs Application is governed by the Amazon WorkDocs Application License Agreement.

Your use of the Amazon WorkDocs Web Clipper is governed by the Amazon WorkDocs Web Clipper License Agreement.

Open with Office is Third-Party Content provided by Microsoft. By using Open with Office , you are subject to Microsoft’s terms of use and privacy policy. You are solely responsible for obtaining all required licenses from Microsoft to use Open with Office and for complying with all applicable Microsoft licensing requirements.

The Hancom document editing service is Third-Party Content. Your use of the Hancom document editing service through Amazon WorkDocs is subject to the Hancom Terms of Service. If you do not accept the Hancom Terms of Service applicable to the Hancom document editing service, then do not enable and use the Hancom document editing service. If you enable and use the Hancom document editing service, Hancom will have access to the contents of the document being edited and the End User’s user name and profile picture. Hancom is only authorized by AWS to access the above information for the purpose of providing the Hancom document editing service and only for the duration of the editing session.

. AWS is the registrant of, and controls the DNS records for, all [name]cromwellpsi.com domain names (“Domain Names”). Customer does not acquire any rights in any such domain. Termination or suspension of Customer’s AWS account may result in the termination or suspension of Customer’s ability to use its previously assigned Domain Names. In order to use a Domain Name, Customer must comply with all guidelines included in the Amazon WorkDocs Site Naming Policy.

Amazon Pinpoint

Portions of Amazon Pinpoint in Japan are sold and provided by AMCS LLC (“AMCS”), an affiliate of AWS, and not AWS, but are otherwise subject to the terms of the Agreement. 

Amazon Pinpoint utilizes underlying functionality from the Amazon Simple Notification Service (Amazon SNS) and Amazon Simple Email Service (SES), and your use of Amazon Pinpoint is subject to the terms that govern those Services.

. You acknowledge that Amazon Pinpoint:

a. Is not an Integrated Public Alert and Warning System (IPAWS) eligible system.

b. Is not intended for use in, or in association with, the operation of any hazardous environments or critical systems. You are solely responsible for liability that may arise in association with such use.

c. Does not support or carry emergency calling or messaging to any emergency services personnel or public safety answering points (“Emergency Services”), such as calls or texts to , and may not determine the physical location of your devices or your End Users, which may be required when contacting Emergency Services. You understand and agree that it is your responsibility to: (i) contact and access Emergency Services independently of Amazon Pinpoint and (ii) inform all End Users of these limitations.

d. Is not a replacement for traditional telephone or mobile phone services, including but not limited to calling, texting, or contacting Emergency Services, and does not function as such.

AWS Lambda

We may delete, upon 30 days’ notice to you, any of Your Content uploaded to AWS Lambda if it has not been run for more than 3 months.

Amazon WorkMail

When you use Amazon WorkMail, you also use AWS Key Management Service, AWS IAM, and Amazon SES, and your use of Amazon WorkMail is subject to the terms that govern those Services.

Amazon WorkMail provides a filtering service designed to filter unwanted emails, such as spam, phishing emails, and email infected with viruses. You acknowledge that the technological limitations of the filtering service will likely result in the capture of some legitimate email and the failure to capture some unwanted email, including email infected with viruses.

Your mail domain and End Users’ accounts may be blocked, delayed, or prevented from being delivered by destination email servers and other reasons outside of our control. Your payment obligations continue regardless of whether delivery of your emails is prevented, delayed, or blocked.

You agree not to use Amazon WorkMail for sending:

  • Bulk emails, such as mass marketing emails
  • Unsolicited and unwanted emails
  • Phishing emails

 You are solely responsible for ensuring any emails you or your End Users send using Amazon WorkMail comply with the CAN-SPAM Act and all other applicable law. You agree that AWS is not the “sender” of any emails you or your End Users send using Amazon WorkMail as defined in the CAN-SPAM Act and all other applicable laws.

Amazon WorkMail may log and use information such as server hostnames, IP addresses, timestamps, mail queue file identifiers, and spam filtering information for the purpose of troubleshooting or improving Amazon WorkMail.

If your use of Amazon WorkMail is terminated, we may delete your data and your End Users’ mailboxes.

Amazon WorkSpaces Application Manager (Amazon WAM)

When you use Amazon WAM, you also use Amazon WorkSpaces, and your use is subject to the terms that govern Amazon WorkSpaces.

 You may use the Amazon WAM Admin Studio only to package applications, and the Amazon WAM Admin Player only to validate applications, that will be delivered via Amazon WAM to your WorkSpaces.

As part of regular operation of Amazon WAM, we may update your Amazon WAM desktop applications with software upgrades, patches, and bug fixes.

AWS Marketplace for Desktop Apps

Except to the extent Content made available through AWS Marketplace for Desktop Apps is provided to you under a separate license that expressly states otherwise, neither you nor any End User may, or may attempt to, (a) modify, alter, tamper with, repair, or otherwise create derivative works of any Content, (b) reverse engineer, disassemble, or decompile the Content or apply any other process or procedure to derive the source code of any software included in the Content, (c) resell or sublicense the Content, (d) transfer Content outside the Services without specific authorization to do so, or (e) tamper with or circumvent any controls or make unauthorized copies of the Content.

AWS may stop providing AWS Marketplace for Desktop Apps (or any features of or listings within AWS Marketplace for Desktop Apps), without prior notice to you. In addition, AWS may disable or remove Content you have purchased on AWS Marketplace for Desktop Apps, if AWS determines that the Content may violate any Policies or any other regulations, policies, or laws.

AWS Directory Service

Use of Microsoft Software on AWS Directory Service is subject to Section above. Microsoft is an intended third-party beneficiary of this Section 34, with the right to enforce its provisions.

AWS Device Farm

For any test run on an Apple device (each, an “Apple Test”), you represent and warrant that you have an active and valid registered Apple Developer Account under your iOS Developer Program License Agreement with Apple at the time any such Apple Test is run. You appoint us as your Authorized Developer (as defined in the Apple Developer Program License Agreement) for the duration of all Apple Tests and understand that you are responsible to Apple for all actions we undertake in connection with each Apple Test.

You agree not to and not to attempt to:

(i) perform any network discovery inside the AWS Device Farm or otherwise in connection with the test;

(ii) generate any internet traffic from within the EC2 instances of AWS Device Farm, unless approved by us; internet traffic should be limited to devices only;

(iii) root, unlock, or jailbreak any Device Farm device;

(iv) install persistent software on devices or EC2 instances; or

(v) factory reset or change settings on devices, or call or access third-party servers in a manner that would interfere with any Services.

You acknowledge and agree that we may disclose application packages, test packages (pre- compiled), test script source code, application extension files, or auxiliary data files to third parties solely for purposes of conducting automated security verification.

Amazon Elasticsearch Service

Amazon Elasticsearch Service creates daily automated snapshots of your Amazon Elasticsearch Service domains. We will maintain these automated snapshots for a period of at least 14 days after they are created. We may delete automated snapshots at any time after 14 days.

AWS Database Migration Service and AWS Schema Conversion Tool

The AWS Database Migration Service (which includes the AWS Schema Conversion Tool) is AWS Content, and you may install and/or use it solely for the purpose of migrating data, provided (i) at least one of the source data store and target data store resides in AWS; and (ii) the source and target data stores are both listed in the Documentation as AWS Database Migration Service sources and targets. You and all End Users may only use the AWS Database Migration Service to migrate data, directly or indirectly, from a source that is a DMS Supported Service to a destination that is also a DMS Supported Service.

AWS Amplify

You must have all necessary rights to use any domain name that you use in conjunction with AWS Amplify.

AWS IoT

Источник: [cromwellpsi.com]
, 1st Email Address Verifier 1.10 serial key or number

Release Notes

Version

September 28th,

Fixed

  • The documented configuration parameter is not picked up by FusionAuth. If you were to override the default value of , the server will properly bind to the correct port, but FusionAuth will not use this local port to connect to itself.

  • When importing users using the Import API on PostgreSQL, if you have a wide distribution of values for the on the User object, you may encounter a PostgreSQL exception.

  • Disable Elasticsearch Sniffer by default. The Elasticsearch Sniffer was enabled in version to allow a single connection to Elasticsearch discover the other nodes in the cluster by the Elasticsearch REST client. This causes problems for cloud managed services or Elasticsearch running within a container service such as k8s. Turn this off by default, and allow it to be enabled if desired. See new configuration property .

Enhancements

  • Add a meta tag to provide a default policy for the browser. Most browsers are now providing a decent default value, but this will ensure a secure default value is utilized. New Themes will default to but this can be modified in the Helper template, and can also be added to existing themes.

Version

September 23rd,

Fixed

  • The default exception handling in the Elasticsearch REST client allows for some expected exceptions to go un-handled which may fail the search request. Add an exception handler to keep these underlying HTTP exceptions from causing failures.

  • Some LDAP exception messages will include an embedded in the message body. PostgreSQL does not allow for embedded characters in a text field, so this may cause FusionAuth to exception when using PostgreSQL.

  • When selecting Re-validate password on login when also restricting usage of previous passwords, the user may end up in a loop of being required to change their during login.

  • In the MySQL migration script, if you have many refresh tokens, it is possible that a duplicate key will be generated due to a poor random Id generator.

Enhancements

Version

September 16th,

Fixed

Version

September 15th,

Fixed

Enhancements

Version

September 12th,

Fixed

  • When using a JWT populate, the JWT returned during a combination User + Registration API request may not have the or arguments available in the lambda. This issue was introduced in version .

  • When using MySQL and Silent Mode database configuration, you may encounter an error indicating or . This issue was introduced in version , if you encounter this error, please upgrade. If you are unable to upgrade, attempt to startup w/out silent mode and go through maintenance mode interactively.

Version

September 10th,

Security

Changes

  • Upgraded Kafka client to

  • Upgrade MySQL connector to

    • If you are using MySQL, and are currently re-packaging the MySQL connector in a Docker image or similar strategy to keep this jar from being downloaded at runtime, you will need to update your version to match FusionAuth.

    • Upgrade your MySQL connector to , the will be expected to be found here ` /usr/local/fusionauth/fusionauth-app/apache-tomcat/lib`.

  • Upgrade PostgreSQL connector to

Fixed

  • The clock skew calculation used then verifying a SAML AuthN response from a SAML v2 IdP may incorrectly cause a validation error. If you encounter this error you may see something like this in the Debug or Error Event Log associated with the SAML v2 login request.

Enhancements

  • Better email address validation to ensure the address will be deliverable.

Version

September 6th,

Fixed

  • Using the External JWT Identity Provider with the Lookup API may fail to validate a JWT

Version

September 4th,

Fixed

  • If you are using the database search engine, FusionAuth may fail to start up correctly.

  • The legacy environment variable named is not honored ahead of the named configuration file property.

Version

September 3rd,

Please Read

This release includes a database migration that may require a few minutes to complete. If you have 1M+ refresh tokens you should plan for a few minutes to allow the schema update to complete. This time will vary significantly based upon the size and performance of your database. Testing upgrades with 2M+ refresh tokens took approximately minutes on bare metal with an SSD. If you&#;re running on a managed database that limits IOPS the migration may be longer. For larger instances it is advised you test the migration ahead of time to identify the downtime required to complete the upgrade.

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Our development team works so hard to bring you cool features and enhancements. Many of the features we build, or the enhancements we make come from the feedback and bug reports we receive from our community.

Thank you to each of you that has taken the time to open a GitHub issue, or raise a concern on our forum. All of this input and feedback is valued, and it makes FusionAuth better!

Changed

There a few changes in this release that you will need to be aware of, please read these carefully. If you have a support contract, please reach out if you have questions or concerns.

  • If you using the SAML v2 Identity Provider Login API directly you will need to update your integration. If you are using the SAML v2 Identity Provider configuration with the FusionAuth themed pages, there is no change required.

    • The Start Identity Provider API must now be used prior to sending the SAML v2 AuthN request to the SAML IdP. You may optionally build your own Request Id, or use one generated by FusionAuth. See the Start API for additional details.

  • The FusionAuth SSO and Admin UI are now stateless and no longer require session pinning to maintain an HTTP session. Leaving existing session pinning in place should not cause any harm, but you may remove it at your earliest convenience.

  • Silent Mode may be used while in runtime mode. This allows you to leverage the FusionAuth maintenance mode to upgrade the database schema for and runtime modes.

  • The Status API no longer returns a full JSON response unless the request is authenticated by an API key or a FusionAUth admin user.

    • The API also now returns several status codes to provide additional insight into possible issues. See Status API documentation for additional information.

  • When building customized field error messages for custom Registration forms, a field error such as may now be . Note the prefix may have changed from to . If you have created customized values for Registration Forms, please review your error messages and test your existing validation to ensure the correct text is displayed.

  • The Linux Debian and RPM packages now ship with a service definition instead of the legacy Sys V init scripts. If the distribution of Linux you are using does not support you will need to plan to upgrade. In most cases this should not affect anyone running FusionAuth on Linux using the provided RPM or Debian packages as bridge scripts generally allow you to start and stop the commands using a Sys V wrapper. See the Starting and Stopping documentation for additional information.

  • When using the python client library, the signature for the method which takes an authorization code has changed. The and parameters flipped positions. This was done to make the signature consistent with the other client libraries. Instead of , the method signature is now . If you don&#;t flip around the arguments, you&#;ll receive a error, similar to this issue.

Known Issues

  • If you are using the database search engine, FusionAuth may fail to start up correctly. Resolved in

  • The legacy environment variable named is not honored ahead of the named configuration file property. Resolved in

New

  • FusionAuth Admin UI and FusionAuth pages are now stateless. As of this version you will no longer need to provide session pinning in a multi-node configuration. If you currently have session pinning configured, it should be ok to leave it, but you should plan to remove it at your earliest convenience.

  • Multi-tenant SSO. This was a limitation prior to this released due to the way we managed the HTTP session. This limitation has been removed&#;&#; and there was much rejoicing. With multi-tenant SSO you may now optionally use the same browser and utilize SSO for users within different tenants, this is often only a dev time issue, but there are some production use cases for this behavior.

    • Resolves GitHub #, thanks to @unkis for opening the issue to help us track this limitation.

  • Expanded and improved configuration options. All config options are not consistent and can be set using , environment variables or Java system properties. This will make life much easier for those running in Docker or Kubernetes. All previously named configuration options will be backwards compatible and you will receive warnings on how you can correct your naming of configuration values or environment variables, because that&#;s how we roll.

  • IdP and Email hinting for the FusionAuth login pages. This feature will allow you to optionally bypass the login page and go directly to the third party IdP based upon the user&#;s email address or a suggested Identity Provider Id. An Identity Provider Id may be provided on the URL using the request parameter, and an email address or domain may be provided in the request parameter.

    • Resolves GitHub #, thanks to one of our FusionAuth All-Stars @davidmw for suggesting this feature.

  • A new API to import Refresh Tokens. See Import Refresh Tokens API for additional details.

  • Application specific email templates for Passwordless, Email Verification, Setup Password, and Change Password. See updates to the Application API and the Application configuration in the FusionAuth admin.

  • A new icon in cornflower blue.

    • I am Jack&#;s complete lack of surprise.

Enhancements

  • Enhanced Maintenance Mode support for initial DB schema setup on 3rd Party cloud managed database services such as Digital Ocean, Azure, etc.

  • The FusionAuth log now ships with a log rotation strategy. This will not affect those running FusionAuth in Docker.

  • All configuration is not available in the file, environment variable or Java System Property to allow for additional flexibility in configuration regardless of your deployment model. See the Configuration reference for additional information.

  • Restrict the response body on the Status API unless authenticated. Provide more granular HTTP response codes to provide insight into the issue.

Fixed

  • When using the View dialog for a custom form field in the FusionAuth admin UI, form type was not displayed.

  • When submitting a custom Registration Form with non-required fields of type , or , you may receive a validation error indicating the value is invalid.

  • Unable to configure through an environment variable for use in Docker.

  • A status code is returned from the Start Passwordless API when more than one tenant exists in FusionAuth.

  • Normalize the use of the claim between the OAuth2 grants, Login API and other APIs that may return a JWT. The claim should always be even when the User is not registered for the application.

  • Custom Form validation errors and related fixes.

  • Both the Login Success and Login Failed events are triggered during a failed login attempt. This bug was likely introduced in version version

Version

August 25th,

Security

  • Improve SAML AuthN Response validation

Version

August 12th,

Fixed

  • HYPR IdP related fixes.

    • When the HYPR authentication workflow begins the provided was not properly validated to exist in FusionAuth. All other IdP configurations allow this scenario, but because HYPR provides MFA and is not itself considered by FusionAuth to be a SoR (source or record) the user must first exist in FusionAuth.

    • Because HYPR is not a traditional SoR and does not provide user claims to FusionAuth, a or address should behave exactly the same when used to initiate the HYPR MFA workflow.

    • Resolves GitHub Issue #

    • Resolves GitHub Issue #

Version

August 10th,

Fixed

  • When using self service registration, a JWT populate lambda and the Implicit Grant, the parameter to the JWT Populate lambda will be .

Version

August 3rd,

Fixed

  • A JavaScript bug may cause some of the reports not to render correctly in the admin UI.

  • A poor performing SQL query was found when using MySQL. The query performance will largely be dependant upon your server configuration, but once you exceed 2M+ login records you may realize some performance issues when logging into the FusionAuth admin UI due to the charts displayed on the main dashboard.

Enhancements

  • Add localized number formatting on the y-axis of charts in the FusionAuth admin UI.

Version

July 30th,

Fixed

  • An exception occurs when you attempt to use a refresh token from tenant A with tenant B.

  • An exception may occur when using self service registration that will disrupt the user registration workflow.

  • The registration object is in the JWT Populate function when used with self service registration.

  • A SAML response that includes an attribute element with the attribute of will cause an exception when we try to parse the XML document.

Version

July 24th,

Fixed

  • When attempting to add a registration for an user in the admin UI, if there are no available registrations to assign after the form has been rendered an exception may occur when you submit the form.

  • When you have enabled verify email on change and you update a user&#;s email address that was previously undefined, a verification email is not sent.

  • When removing a user&#;s registration, the search index is not updated correctly until the next user index event.

  • Fixes form field name validation to limit spaces and other special characters.

  • Form and field fixes including some JavaScript errors and the complete registration workflow when a custom form is used.

  • The use of is failing validation when used in an email template.

    • Resolves GitHub Issue #, this to @seanadkinson for reporting the bug.

    • Email template validation has been relaxed to allow the Preview API and UI action to report errors and warnings but still allow the changes to be saved. Due to the complexity of validating the email template without the exact data to be used at runtime, validation has been relaxed to ensure we do not prohibit a valid template from being saved. When using the UI to manage your templates, you will now find a test button which will allow you to send a template to an end user to test the rendering and delivery with a real user.

Version

July 20th,

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Fixed

  • When running with PostgreSQL database and migrating from pre with existing users, the table sequence may not be set correctly causing new users to fail to be created.

Version

July 19th,

Fixed

  • An issue introduced in version may cause the edit Application action in the admin UI to fail with a message. Review the known issues of for a workaround if you are unable to upgrade to version

Version

July 19th,

Please Read

This release includes a fairly significant database schema upgrade. If you have 1M+ users you should plan for a few minutes to allow the schema update to complete. This time will vary significantly based upon the size and performance of your database. Testing upgrades with 3M+ users took approximately minutes on bare metal with an SSD. If you&#;re running on a managed database that limits IOPS the migration may be longer. For larger instances it is advised you test the migration ahead of time to identify the downtime required to complete the upgrade.

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Known Issues

  • When editing an application in the admin UI you may encounter a error message when attempting to save your changes. As a work around, you may ue the API to modify the application. To resolve the issue, please upgrade to version

  • If running PostgreSQL database a database sequence may not be set correctly causing a status code when creating new users.

  • An exception may occur when using self service registration that will disrupt the user registration workflow.

  • A JWT populate lambda that uses the parameter may fail when using self service registration.

Changed

  • In the FusionAuth admin UI, Email Templates and Themes are now found under the menu.

New

  • Advanced Forms. Self service registration just got a huge upgrade! Now custom forms may be configured with one to many steps, each step consisting of one to many fields. A registration form may then be assigned to an application in the Self service registration configuration found in the tab. Assigning a custom form to an application will require a licensed edition of FusionAuth. More details and documentation coming soon.

  • Initial Tech Preview of Connectors. Connectors allow you to authenticate against external systems such as LDAP. A generic connector can also be configured to authenticate against any third party system. More details and documentation coming soon. When using a connector, you will utilize the Login API or OAuth frontend of FusionAuth as you normally would and the tenant may configure policies that would cause users to be authenticated against these external databases.

Enhancement

  • When viewing the Application view dialog, an additional property named will be provided in the OAuth2 & OpenID Connect Integration details section. You may use this value to copy/paste a URL for testing a direct link to the registration page.

  • When viewing the About panel found in the administrative UI, the node IP address will be reported.

  • The JSON Web Tokens issued by FusionAuth will now include the claim.

  • All objects now have an and a property in the JSON API response.

  • Public keys stored with a certificate will have the property provided in the JSON Web Key Set response.

Fixed

  • The user registration event may be missing the property.

  • A user with one or more consents granted fails to be deleted.

  • When using COPPA consent with Email+, the second email is not sent to the parent.

  • The Refresh Token cookie is written without a attribute on the JWT Refresh API response. This causes the cookie to be treated as a session cookie.

Version

July 3rd,

Fixed

  • API validation fails on the Audit Log API when a JSON body is omitted from the HTTP request.

  • Fixing a bug that prevents the Kafka integration from working correctly.

  • When selecting an Application in the user search controls in the UI an invalid Elasticsearch query causes an error on Elasticsearch version The query seems to be working on versions , , and , as far as we can tell it only fails on the most recent versions of Elasticsearch.

Enhancement

  • Add a return to login link to the default templates for Passwordless, Register, Forgot, and Password Sent.

Version

June 25rd,

Fixed

  • A JavaScript bug caused the device verification URL field to toggle to hidden when any grant was enabled or disabled in the UI. This is primarily a cosmetic issue, if you encounter it you may simply refresh the page.

  • The Search API performs a validation step when using Elasticsearch, and if Elasticsearch returns we fail the request. We are now always including the explanation from the Elasticsearch response in our error message on the API to assist the developer to understand why the requested query is considered invalid.

  • The Apple Service Id override that can be provided per application was not being used, instead the global value was utilized.

Version

June 23rd,

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Enhancement

  • When configuring an OpenID Connect Identity Provider, the claim that contains the user&#;s email address may now be modified. This allows the OpenID Connect Identity Provider to be more flexible when configured with non-standard OpenID Connect providers or other OAuth2 providers such as LinkedIn.

Version

June 17nd,

Fixed

  • When using , and few other references in an email template, the validation step may fail unless you provide a null safe usage.

Version

June 15nd,

Fixed

  • In version Key Master supports importing a standalone private key. If you attempt this request in the UI with an RSA private key an error will occur.

  • When using an expired Forgot Password link if you have not added the to the URL in the email template you will see an unexpected error when you attempt to begin the process again by entering your email address. You may also experience this error if you are sending users directly to instead of the user clicking the link during an OAuth2 workflow.

Version

June 2nd,

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Please Read

This change includes some modifications to the way Lambdas are used with Identity Providers. If you are using an OpenID Connect or SAML v2 Identity Provider with a custom Lambda, please read all of the release notes to ensure a smooth upgrade.

Changed

  • All Identity Provider configurations that did not have a lambda configured for User reconcile have been migrated to utilize a lambda to extract all optional user details from the IdP response. This allows you to have complete control over how these configurations work and what information is set or written to the user object during login. The business logic has not changed, but it has been moved from an internal FusionAuth service to a Lambda that can be modified. The following Identity Providers are affected:

    • All Facebook, Google and Twitter Identity Provider configurations

    • OpenID Connect and SAML v2 Identity Provider configurations without a configured lambda.

  • OpenID Connect and SAML v2 Identity Providers that were already configured with a lambda may require some manual migration. The claims that were mapped into the User by FusionAuth prior to this version have been moved into a lambda so they may be modified. For each of your OpenID Connect or SAML v2 Identity Provider configurations that already had a Lambda configured for User reconcile, please review to ensure all of the claims you desire are handled by your lambda.

  • For OpenID Connect Identity Provider configurations, review the new Lambda named . Optionally copy any of the code you&#;d like to have executed into your configured Lambda and then test your integration. Specifically, the registered claims , , , , , , , and are now managed by the Lambda. If you would like these claims reconciled to the FusionAuth user, review the referenced Lambda function.

  • For SAML v2 Identity Provider configurations, review the new Lambda named . Optionally copy any of the code you&#;d like to have executed into your configured Lambda and then test your integration. Specifically, the SAML claims for , , , , and are now managed by the Lambda. If you would like these SAML claims reconciled to the FusionAuth user, review the referenced Lambda function.

New

  • Sign in with Apple. A new Identity Provider of type is now available to enable Sign in with Apple support.

  • One time Use Refresh Tokens. A one time use refresh token means that each the time the refresh token is used to get a new access token (JWT) a new refresh token is returned. This feature must be enabled at the tenant level, and can optionally be overridden by the Application JWT configuration.

  • Sliding Window Refresh Token Expiration. By default the expiration of a refresh token is calculated from the time it was originally issued. Beginning in this release you may optionally configure the refresh token expiration to be based upon a sliding window. A sliding window expiration means that the expiration is calculated from the last time the refresh token was used. This expiration policy means that if you are using refresh tokens to maintain a user session, the session can be maintained as long as the user remains active. This expiration policy must be enabled at the tenant level, and may optionally be overridden by the Application JWT configuration.

  • Facebook, Google, HYPR and Twitter Identity Providers may be assigned a User Reconcile Lambda.

    • Previously the user reconcile logic was built into FusionAuth. Now the User reconcile logic has been moved to a lambda to provide additional control over attributes are extracted from the Identity Provider response and set into the FusionAuth user.

Enhanced

  • Some development and possibly runtime errors that are used during external logins such as Facebook were not localized. These values may not be localized in your theme configuration.

  • Large cookies may cause the default maximum header size of 8k to be exceeded. When this occurs the request will fail and you may see an exception with a status code indicating .

    • This value may now be modified via configuration. See the Configuration reference or additional information.

    • Resolves GitHub Issue #, thanks to @shortstack for letting us know, providing great debug and confirming the fix.

  • When a user is registered, a refresh token will not be returned. This makes this API response consistent with the User Create API.

  • When configuring a SAML v2 Identity Provider, a warning will be added to the Identity Provider index page if the CORS configuration is not adequate to allow the login request to complete. The configuration will generally require a request from a particular origin be allowed through the CORS filter.

    • This should help reduce CORS configuration issues causing a during integration testing.

    • Resolves GitHub Issue #

Fixed

  • When importing a key using Key Master in the admin UI, when a key with an invalid length is imported the error was not being displayed.

  • The hosted FusionAuth log page may fail to function properly after the user changes the locale using the locale selector on the themed page. Specifically, once you add more than one language to your theme, and the user continues past the first login panel to a subsequent themed page, if the user switches the locale the context will be lost and the user will see an OAuth error.

  • A non POSIX compliant function definition in caused FusionAuth to fail to start on Ubuntu and (possibly others). This could be on any Linux distribution that sym-links to which is a POSIX compliant shell. This was introduced in version

  • When using the Facebook IdP and specifying as one of the requested an error occurs during the User reconcile process which causes the login to fail. If you encounter this issue, the work around is to remove from the field configuration, even with this change you will still get the picture back from Facebook as FusionAuth makes a second call to the Me Picture API.

Version

May 18th,

Fixed

  • When attempting to utilize a silent configuration to configure the database schema without using Elasticsearch, FusionAuth would enter maintenance mode.

Version

May 8th,

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Security

  • A vulnerability in an underlying SAML v2 library was resolved. If you are using SAML please upgrade FusionAuth to or later as soon as possible.

Changed

  • The favicon configuration in the default theme has been updated. If you have created your own theme and kept the default favicons using the FusionAuth logo you will want to either remove them or update them with the correct paths. See the default theme for reference if you would like to use the FusionAuth favicons.

New

  • The Identity Provider Lookup API will return a list of to represent the enabled FusionAuth applications for the identity provider.

  • The Identity Provider Lookup API will return the SAML v2 value configured in the SAML v2 IdP.

Fixed

  • Specifying an Elasticsearch URL containing basic auth credentials works properly. For example the URL now functions as expected.

  • Fixed a validation error when using the Import User API w/ an empty list of users. A status code with a JSON response should have been returned.

  • Some JavaScript may fail on Internet Explorer version Specifically the which is used to handle the external login providers on the login page.

  • A validation error in the OAuth2 Token endpoint returns a general error instead of the appropriate validation error.

  • When using the Facebook login, it is possible that Facebook will send back an Image URL from the API that will exceed characters. If this occurs the login failed and an an exception was logged.

  • Attempting to validate or save an Email template that contains a reference to a value stored in user data may cause an exception. For example is a valid usage, but this would fail validation or cause an exception during validation.

  • In some cases, when a webhook fails to respond and subsequently fails the request do to the configured transaction setting the Elasticsearch index will be out of sync.

  • An extra curly bracket caused the SQL migration to fail if you are running PostgreSQL and performed an upgrade without modifying the default tenant.

Fixed from RC.1

The following issues were fixed that only affect those running version RC

  • An unexpected request parameter may cause an exception due to the incorrect runtime mode.

Version RC.1

April 21st,

Database migration

The database schema has changed and an upgrade is required for this version of FusionAuth. You will be prompted to upgrade the database by maintenance mode before you may login.

See Database Upgrades for more information about database migrations.

Please Read

This is a release candidate. This release is not intended for production use. If you encounter issues please open a GitHub issue to let us know.

Changed

  • Email Send API no longer requires a from email or a default from name, defaults may be taken from the tenant. See the Emails API documentation for reference.

  • The OpenID Connect JSON Web Key Set API endpoint returns only public keys generated by FusionAuth. This endpoint previously also returned imported public keys, for which we do not hold the private key.

Security

  • Updated default CORS configuration for clean installs, see the CORS Reference for details. It is highly recommended you modify your CORS configuration to match our new default values unless you have a technical requirement for your existing CORS configuration.

  • Upgrade Handlebars to version due to a known vulnerability. There is no known exploit of this vulnerability in FusionAuth, this is a pro-active upgrade. FusionAuth uses this JavaScript library in the administrative UI to build dynamic table roles.

Enhancement

  • The OpenID Connect and SAML v2 Reconcile Lambda may now modify the assigned user roles. Prior to this version any changes to the roles were intentionally not preserved. This restriction has been lifted.

  • In some cases the parameter returning from external SAML v2 & OpenID Connect identity providers is decoded incorrectly. We are now Base64 encoding this value to preserve it&#;s integrity.

New

  • Support for Elasticsearch version 7

    • FusionAuth maintains backward-compatibility with Elasticsearch x clusters and indexes.

    • configuration property and environment variable exposed for configuring the search engine, see the Configuration documentation for reference.

    • A reindex may be necessary depending on how you have upgraded your Elasticsearch cluster. You may issue a reindex in the FusionAuth Admin UI under System &#; Reindex.

    • Resolves GitHub Issue #

  • Support for using the database as the user search engine. This is now the default configuration. See the Core Concepts - Users documentation for details.

  • The Registration API returns an access token within the field of responses to requests. See the Registrations API documentation for reference.

    • Application registration records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.

  • The is now optional for requests (update login instants) to the Login API. See the Login API documentation for reference.

    • requests to the Login API records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.

  • The User API returns an access token within the field of responses to requests creating a user. See the User API documentation for reference.

    • User creation records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.

  • System logs can be viewed from the Admin interface. Navigate to System &#; Log

Источник: [cromwellpsi.com]
1st Email Address Verifier 1.10 serial key or number

OpenSSL

  • Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello

    Benjamin Kaduk

  • Add SM2 base algorithm support.

    Jack Lloyd

  • sx assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb.

    Patrick Steuer

  • Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only.

    Richard Levitte

  • Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates.

    Billy Bob Brumley, Nicola Tuveri

  • Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than bits is lowered to 2^

    Kurt Roeckx, Annie Yousar

  • Increase the number of Miller-Rabin rounds for DSA key generating to

    Kurt Roeckx

  • The 'tsget' script is renamed to 'cromwellpsi.com', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well.

    Richard Levitte

  • Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication.

    Andy Polyakov

  • Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands.

    Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri

  • Add a scaffold to optionally enhance the Montgomery ladder implementation for (formerly ) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms.

    Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri

  • Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open().

    Paul Dale

  • Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors.

    Matt Caswell

  • AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between and side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed.

    Andy Polyakov

  • Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default.

    Billy Bob Brumley

  • Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks.

    Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley

  • Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group).

    Matt Caswell

  • Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation.

    Matt Caswell

  • SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again.

    Kurt Roeckx

  • When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases.

    Richard Levitte

  • Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation.

    Billy Bob Brumley

  • Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves.

    Billy Bob Brumley

  • Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication.

    Billy Bob Brumley

  • Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). Billy Bob Brumley, Nicola Tuveri, Cesar Pereida García, Sohaib ul Hassan

  • Updated CONTRIBUTING

    Rich Salz

  • Updated DRBG / RAND to request nonce and additional low entropy randomness from the system.

    Matthias St. Pierre

  • Updated 'openssl rehash' to use OpenSSL consistent default.

    Richard Levitte

  • Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised.

    Matt Caswell

  • Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA

    Matt Caswell

  • Fixed X_NAME_ENTRY_set to get multi-valued RDNs right in all cases.

    Ingo Schwarze, Rich Salz

  • Added output of accepting IP address and port for 'openssl s_server'

    Richard Levitte

  • Added a new API for TLSv ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites()

    Matt Caswell

  • Memory allocation failures consistently add an error to the error stack.

    Rich Salz

  • Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid.

    Bernd Edlinger

  • Load any config file by default when libssl is used.

    Matt Caswell

  • Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview.

    Matthias St. Pierre

  • QNX support removed (cannot find contributors to get their approval for the license change).

    Rich Salz

  • TLSv replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details.

    Matt Caswell

  • Separated TLSv ciphersuite configuration out from TLSv ciphersuite configuration. TLSv ciphersuites are not compatible with TLSv and below. Similarly TLSv ciphersuites are not compatible with TLSv In order to avoid issues where legacy TLSv ciphersuite configuration would otherwise inadvertently disable all TLSv ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information.

    Matt Caswell

  • On POSIX (BSD, Linux, ) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr.

    Viktor Dukhovni

  • Added support for X and Ed Heavily based on original work by Mike Hamburg.

    Matt Caswell

  • Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them.

    Richard Levitte

  • Support for TLSv added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv For further information see: cromwellpsi.com

    Matt Caswell

  • Grand redesign of the OpenSSL random generator

    The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.

    Some of its new features are:

    • Support for multiple DRBG instances with seed chaining.
    • The default RAND method makes use of a DRBG.
    • There is a public and private DRBG instance.
    • The DRBG instances are fork-safe.
    • Keep all global DRBG instances on the secure heap if it is enabled.
    • The public and private DRBG instance are per thread for lock free operation

    Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre

  • Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./cromwellpsi.com should be used as a script to display all sorts of configuration data.

    Richard Levitte

  • Added processing of "make variables" to Configure.

    Richard Levitte

  • Added SHA/ and SHA/ algorithm support.

    Paul Dale

  • The last traces of Netware support, first removed in , have now been removed.

    Rich Salz

  • Get rid of cromwellpsi.com, and in the process, make the processing of certain files (cromwellpsi.com, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent).

    Richard Levitte

  • Make it possible to have environment variable assignments as arguments to config / Configure.

    Richard Levitte

  • Add multi-prime RSA (RFC ) support.

    Paul Yang

  • Add SM3 implemented according to GB/T Jack Lloyd cromwellpsi.com@cromwellpsi.com,Ronald Tse cromwellpsi.com@cromwellpsi.com,Erick Borsboom cromwellpsi.comom@cromwellpsi.com

  • Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC Based on a patch from Tomasz Moń

    Filipe Raimundo da Silva

  • Add SM4 implemented according to GB/T Jack Lloyd cromwellpsi.com@cromwellpsi.com,Ronald Tse cromwellpsi.com@cromwellpsi.com,Erick Borsboom cromwellpsi.comom@cromwellpsi.com

  • Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change.

    Rich Salz

  • Add ARIA AEAD TLS support.

    Jon Spillett

  • Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since

    Rich Salz

  • Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors.

    Richard Levitte

  • Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_cromwellpsi.com for application requirements. The RAND facility now uses/requires this.

    Rich Salz

  • Add SHA3.

    Andy Polyakov

  • The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).

    To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE.

    Richard Levitte

  • Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme.

    Richard Levitte

  • Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them.

    Richard Levitte

  • Module names can prefixed with OSSL_ or OPENSSL_. This affects util/cromwellpsi.com, which is adapted to allow those prefixes, leading to error code calls like this:

    With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules.

    Richard Levitte and Tim Hudson

  • Removed BSD cryptodev engine.

    Rich Salz

  • Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there.

    Richard Levitte

  • In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed.

    Richard Levitte

  • Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL

    Tomas Mraz tmraz@cromwellpsi.com

  • Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv prohibits this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause interoperability issues.

    Matt Caswell

  • Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL

    Richard Levitte

  • Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t.

    Richard Levitte, Andy Polyakov

  • Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc.

    Richard Levitte

  • Have 'config' recognise bit mingw and choose 'mingw64' as the target platform rather than 'mingw'.

    Richard Levitte

  • The functions X_STORE_add_cert and X_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs.

    Paul Dale

  • x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines.

    Andy Polyakov

  • Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op.

    Richard Levitte

  • Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V, which is the minimum version we support.

    Richard Levitte

  • Certificate time validation (X_cmp_time) enforces stricter compliance with RFC Fractional seconds and timezone offsets are no longer allowed.

    Emilia Käsper

  • Add support for ARIA

    Paul Dale

  • s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername".

    Matt Caswell

  • Add support for SipHash

    Todd Short

  • OpenSSL now fails if it receives an unrecognised record type in TLS or TLS Previously this only happened in SSLv3 and TLS This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them.

    Matt Caswell

  • 'openssl passwd' can now produce SHA and SHA based output, using the algorithm defined in cromwellpsi.com

    Richard Levitte

  • Heartbeat support has been removed; the ABI is changed for now.

    Richard Levitte, Rich Salz

  • Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd.

    Emilia Käsper

  • The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL.

    Rich Salz

  • Источник: [cromwellpsi.com]
    .

    What’s New in the 1st Email Address Verifier 1.10 serial key or number?

    Screen Shot

    System Requirements for 1st Email Address Verifier 1.10 serial key or number

    Add a Comment

    Your email address will not be published. Required fields are marked *