StreamSec Tools 4.1.5.363 was released on 2026-11-09 and is in the Download Area now. Security support for this release runs until 2031-11-09. Its change log, CHANGES_4.1.5.363.txt, and its SBOM are attached to this post. The SBOM is for the licensed release and describes none of the evaluation builds.

There are no new major features. This is a maintenance release of 100 change-log entries, and its largest items are certificate revocation and the mail suite. Numbers in parentheses are entry numbers.

CERTIFICATE REVOCATION

- The CRL cache and startup (66). LoadCRL now compares an authenticated list with the list loaded, the cache file and every other list of that issuer and scope in the cache directory, and refuses a lower number, an earlier thisUpdate or different signed contents at the same number, also after a restart. A startup scan keeps the same order. Four older defects of the CRL filter are fixed with it; two of them lost the revocations of lists it went on holding, so a revoked certificate was accepted.

- The verdict a certificate store keeps (97). TsmX509TrustedCertificates answered from a kept verdict for up to RevocationCacheMaxAge seconds, 3600 by default, so a CRL added in that time was not looked at. Now a CRL added or replaced ends the use of every kept verdict except a revocation. A TLS peer whose certificate the store already held had no revocation check and was accepted after that certificate expired. It now goes through the store's revocation check and is refused when that check answers revoked, revocation unknown or CRL expired, or when the certificate has expired and BeforeImportTLSCert does not allow it. Entry 98 states two known limits of that check.

- A CA certificate that a CRL revokes (98). The chain check read only the CRLs of the store it ran in, so with TsmStreamSecII an intermediate CA in CollectedCertificates was never compared with a CRL in CACertificates that revokes it. Now it is, also for a peer the store already holds.

TLS

- A TLS 1.3 client did not check the server certificate's extended key usage or key usage, and TLS 1.2 skipped that for a certificate the engine knew. Both now check every server certificate. A certificate matching none of DNSNameToCheck, IPToCheck and URIToCheck now ends the handshake on both versions (26).
- A TLS 1.2 server could raise an access violation on the CertificateVerify of an accepted ECDSA client certificate (53).

THE MAIL SUITE

Fixed in this release:
- IMAP FETCH refused the body section forms that clients use to list and read messages (1), and a session was not told of new mail (3, 50). A UID could come to name a second message (6, 8, 17).
- The submission port took MAIL FROM from a session that had not authenticated (9), and an authenticated account could give any sender address (71).
- Ten wrong passwords locked an account for everybody. They now lock out the source address (51, 79).
- IMAP allocated a literal's announced size before sign-in (35). Silent or resetting clients could hold every slot of a plain port for the protocol's whole idle limit (47, 48), and silent ones a slot on an implicit-TLS port with no limit after the handshake (49).
- With DNS not answering, VerifyInbound accepted a forged sender of a p=reject domain (52).

TIME ZONES

Built with Delphi for Linux64, macOS, iOS or Android, OffsetFromUTC dropped the minutes of the offset, so in a zone such as India (+5:30) the library's UTC was 30 minutes off. It is used for CRL and OCSP dates and for CMS and PDF signing times, among other things (99).

WHAT CHANGES WHEN YOU UPGRADE

65 of the 100 entries are marked BEHAVIOUR CHANGE. 46 concern the mail suite; the other 19 are 22-24, 26-29, 46, 54-56, 59, 61, 62, 66, 68, 70, 97 and 98. Please read those that apply to you before you upgrade. The ones you are most likely to meet:

- LoadCRL needs one cache file name per issuer and scope (66).
- A handshake with a peer the store holds can now be refused (97, 98) and can make an OCSP request or download a CRL (97).
- Hold one complete CRL per issuer in a store, no partitions or delta CRLs, and the CA's own certificate in the store the check starts from, ahead of its cross certificates and of anything a peer can add, or use OCSP (98, known limits).
- DNSNameToCheck takes a bare host name (28). Code that drives the TLS layer directly should read the new close contract (26).
- Code that tests ServerCertificate for nil to learn whether the server was accepted must use ServerCertificateAccepted, and a refused leaf now stays in CollectedCertificates (26).
- With the Indy adapter OnConnect can run before the handshake: call StartSSL there if it needs the client certificate (61).
- Unauthenticated submission is refused unless the peer is in RelayNetworks (9), and MAIL FROM must be the account's own address (71).
- On 465, 993 and 995 the idle and session limits now apply by themselves, but a limit per address is yours to set: TsmAsyncTLSServer.MaxConnectionsPerPeer is 0 by default, and MAIL.txt section 10 shows the assignments (49).
- An access violation on a mail thread now ends the process, with exit code 70 (20, 38).
- Your own iMailboxAccess, iMailboxView or iImapServerPolicy must add new methods and change existing signatures (8, 18, 20, 21, 74-77, 84).
- The embedded root set comes from the CCADB, whose Data Usage Terms name CDLA-Permissive-2.0 as the licence of its data; SBOMs through 4.1.5.362 said MPL-2.0. The agreement's text now ships as LICENSE-CDLA-Permissive-2.0.txt, which gives the addresses of the sources and says which binaries carry the certificates (33).

Smaller additions: IMAP MOVE, SPECIAL-USE, keywords and QUOTA (74-77), and tCertificateReloader, which follows a PFX file (25, 29).

Evaluation builds for Delphi XE3 to 13 are on the download page; they carry no long-term support. PKIX is described here and the mail suite here