Relution Signet Customer Hub

Shield Changelog

Subscribe: RSS Atom

This page lists the changes to Relution Shield for each version released as the Docker image relution/relution-shield on Docker Hub. Installation and configuration are described in Relution Shield →.

Available versions

The 2-latest tag used in the installation guide currently points to version 26.1.0 (as of 9 November 2026). Newer versions are referenced by their version number in the image, for example relution/relution-shield:26.3.1.

Version 26.3.1

2026-11-04

Updates
  • Connections without EAP or XAuth authentication are rejected. The device ID is determined exclusively from the EAP identity and no longer from the IKE identity. The example configurations for iOS and Android Enterprise use EAP and are not affected
  • Device IDs are checked against a fixed format before the access check (4 to 64 characters, letters, digits, - and _); other IDs are rejected
  • New environment variable ACCESS_CHECK_FAIL_OPEN (default true) defines whether devices with a valid certificate are accepted when their status cannot be determined. It replaces RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE; the previous name is still evaluated as long as ACCESS_CHECK_FAIL_OPEN is not set
  • New environment variable DEVICE_COMPLIANCE_DIR for the directory inside the container in which the compliance status is cached (default /opt/strongswan/compliance)
  • Control characters are removed from the peer identities before they are written to the log
  • Security improvements and hardening
Fixes
  • A response from the Relution server that cannot be evaluated, such as a proxy error page, is treated like an unreachable server and follows the ACCESS_CHECK_FAIL_OPEN setting
  • If the compliance status cannot be cached, the result returned by the Relution server still applies

Version 26.3.0 was not released on Docker Hub; its changes are included in 26.3.1.

Version 26.2.0

2026-09-08

Updates
  • The environment variables RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE and DEVICE_STATE_CACHE_DURATION_MINUTES are passed to the access check and take effect as of this version [REL-12795]
  • Update to strongSwan 6.1.0

Version 26.1.0

2026-06-09

Updates
  • Update to strongSwan 6.0.7

Version 26.0.0

2026-03-23

Updates
  • The version number follows the scheme of the Relution versions
  • Update to strongSwan 6.0.5

Version 2.0.3

2025-12-22

Updates
  • Diagnostic tools (binutils) in the image for analyzing crash reports
  • Custom modifications to the strongSwan source code removed; the image uses strongSwan unmodified
Older versions

Version 2.0.2

2025-11-04

Updates
  • Update to strongSwan 6.0.3

Version 2.0.1

2025-07-28

Updates
  • Update to strongSwan 6.0.2

Version 2.0

2025-06-04

New
  • Configuration via swanctl.conf with the charon daemon instead of the previous ipsec.conf [REL-7961]
  • Environment variable RELUTION_ACCESS_CHECK_SCOPE for access checks across all organizations (global) [REL-8252]
Updates
  • Update to strongSwan 6.0.1 and Ubuntu 24.04 [REL-8251]
  • Consistent names for the environment variables: REST_API_ACCESS_TOKEN is now RELUTION_REST_API_ACCESS_TOKEN, HEALTHCHECK_ID is now RELUTION_HEALTHCHECK_ID [REL-8252]
  • Docker tag 2-latest instead of latest

The procedure for switching from version 1.x is described in Upgrade from 1.x to 2.x →.