Thyris CLS Version Support and Annual Key Rotation
Thyris CLS (Centralized License Service) rotates product-license signing keys on a scheduled annual cycle. Product images contain public verification keys only; signing private keys are never included in customer images.
Supported rotation images carry an overlapping public trust set so they can verify the current signing cycle and the prepared next cycle. Shipping the next public key does not activate it. Thyris changes the central signer only after the compatible images have been released and tested in Thyris CLS.
The new annual key becomes primary on 10 January. A 120-day transition period runs through 10 May, allowing supported customer installations to move to a compatible product image. A security incident may require an earlier emergency rotation.
Does rotation require a feature upgrade?
Not necessarily. For an older release line that remains supported, Thyris may publish a maintenance image containing the refreshed public verification set without adding new product features. Customers can remain on that supported release line while applying the required security maintenance image.
Release lines that have reached End of Support do not receive new key-ring maintenance images. Such versions may stop renewing their licenses after the published transition deadline. The applicable product support matrix and image release notes determine support; the image's calendar year alone does not.
Annual customer calendar
Download and import the customer milestones: 2027 license rotation calendar.
| Date | Customer action |
|---|---|
| 1 November | Review the announced supported-version and EOS matrix. |
| 1 December | Compatible maintenance images are published; begin upgrade validation. |
| 5 January | Complete production readiness checks. |
| 10 January | New signing cycle begins; the 120-day transition starts. |
| 11 March | Confirm every installation is running a compatible supported image. |
| 10 April | Resolve remaining installations before final retirement. |
| 1 May | Complete final offline and exception checks. |
| 10 May | Previous-cycle compatibility ends. |
All dates follow the Europe/Istanbul timezone unless a product notice states otherwise.
2027 cycle
For the upcoming cycle:
- 1 November 2026: review the 2027 support/EOS announcement;
- 1 December 2026: begin testing the compatible maintenance image;
- 15 December 2026: complete the first adoption checkpoint;
- 5 January 2027: finish the production go/no-go review;
- 10 January 2027: the 2027 key becomes primary;
- 11 March 2027: 60-day migration checkpoint;
- 10 April 2027: 90-day final escalation checkpoint;
- 1 May 2027: complete final exception and offline checks;
- 10 May 2027: the 120-day transition ends.
ACP Engine maintenance images prepared on or after 14 October 2026 include the overlapping public verification set for the 2027 transition. The current signing cycle remains active until the scheduled central change; installing a compatible image does not activate or expose a private signing key.
Offline installations
Offline installations must upgrade to a compatible supported image and obtain a replacement signed bundle before the communicated deadline. An offline bundle does not extend the support life of an obsolete product version.
Plan image and bundle changes with Thyris Support. Do not copy bundles between installations or attempt to add verification keys through runtime configuration.