---
title: "Release 2.3.8"
slug: "clone-release-2-3-8"
description: "Personal Certificate Client 2.3.8 is mandatory September 17, 2026, adding FIPS 140-3 compliance, CRL blocking, LTV support, and improved PIN dialogs."
updated: 2026-11-03T21:47:35Z
published: 2026-11-03T21:47:35Z
canonical: "docs.onespan.com/clone-release-2-3-8"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Release 2.3.8

Beginning **September 8th, 2026**, you will be prompted to install this version of the Personal Certificate Client. The 2.3.8 version of the Personal Certificate Client is MANDATORY as of **September 17th, 2026**. If you did not install this version of the PCC by this date your configurations will no longer work.

## What's New

Here are some of the new features and enhancements we have made for this release.

### FIPS 140-3 compliance

Cryptographic libraries and algorithms have been updated to ensure compliance with the FIPS 140-3 standard.

On Windows, the Consumer and Corporate editions of PCC are FIPS 140-3 compliant.

### Optional blocking of large CRLs sent to OSS servers

**Optional blocking of large CRLs sent to OSS servers:** When signing documents, PCC collects revocation data (CRLs and/or OCSP responses) and sends it to the server to enable the creation of Long-Term Validation (LTV) signatures. Some Certificate Authorities (CAs) publish exceptionally large Certificate Revocation Lists (CRLs), which can exceed the server's maximum request size and cause signing operations to fail. A new configuration option allows CRLs larger than a specified maximum size to be excluded from transmission, helping prevent such failures. For more information see [Limiting the size of CRLs sent to the server](/v1/docs/limiting-the-size-of-crls-sent-to-the-server).

#### Long Term Validation (LTV)

In this release note, **Long-Term Validation (LTV)** refers to the **“LTV enabled”** status reported by Adobe Acrobat Reader. This status depends on revocation data (CRLs and/or OCSP responses) being embedded in the signed document. It is not the same as a PAdES long-term validation signature, as explained below.

#### How Adobe Acrobat Reader reports LTV status

|  | Revocation data embedded | Revocation data not embedded |
| --- | --- | --- |
| **Signature Panel message** | Signature is LTV enabled | Signature is not LTV enabled and will expire after [certificate expiration date] |
| **Status before certificate expiration** | **Valid** | **Valid** |
| **Status after certificate expiration** | **Valid** (unchanged) | **Unknown** (icon changes from green to yellow) |

#### PAdES long-term validation requires a timestamp

The “LTV enabled” status reported by Adobe Acrobat Reader does not by itself indicate that a signature includes a timestamp, or that it complies with PAdES. **A PAdES long-term validation signature (PAdES-B-LT or PAdES-B-LTA) requires a signature timestamp issued by a Time Stamping Authority (TSA)**, in addition to the embedded validation data. These levels are defined in [ETSI EN 319 142-1, PAdES digital signatures; Part 1: Building blocks and PAdES baseline signatures](https://www.etsi.org/deliver/etsi_en/319100_319199/31914201/01.02.01_60/en_31914201v010201p.pdf).

#### Timestamp and PAdES LTV support in OneSpan Sign

Depending on the configuration, OneSpan Sign and PCC support creating signatures that include a timestamp from an accredited TSA, and signatures that comply with PAdES long-term validation requirements. For more information, contact [OneSpan Support](https://www.onespan.com/support).

### Additional New Features

**Improved PIN dialog window focus on Microsoft Windows:** [Release 2.3.6](/v1/docs/release-236) introduced enhanced logic to ensure the PIN dialog appears in front of the browser window. This release further refines this behavior to improve reliability and maintain compatibility with future Windows updates.