[5.1] - July 15, 2025

Fortanix Data Security Manager (DSM) SaaS 5.1 comes with some exciting new features, general improvements, and resolved issues.

NOTE

This release is for SaaS only and is not available for on-premises installations. Updates in this release will be part of a future on-premises release.

1. New Features

• Fortanix DSM now supports the following new features for Key metadata policy (JIRA: EXTREQ-887):

  • Defining an account-level Key metadata policy that allows setting default and maximum key expiry values in the policy definition. 
    For more information, refer to the User’s Guide: Account Key Metadata Policy.

  • Setting default key expiry in the group-level Key metadata policy definition.
    For more information, refer to the User’s Guide: Group Key Metadata Policy.

• Fortanix DSM now supports requiring a DSM application to authenticate using both a client TLS (Transport Layer Security) certificate and an in-band authentication method (such as an API key, JSON Web Token, External Directory and AWS IAM), providing strong multi-factor authentication through the DSM user interface (JIRA: EXTREQ-1040).
  For more information, refer to the User's Guide: Authentication.

• Fortanix DSM now supports a new key type for Irreversible Tokenization to allow secure format-preserving tokenization with no decryption or detokenization capabilities (JIRA: EXTREQ-861).
  For more information, refer to the User’s Guide: Tokenization.

• Fortanix DSM Dashboard now displays the total number of configured Cloud Data Control (CDC) connections in a Fortanix DSM account (JIRA: PM-266). 
  It includes the number of:

  • Amazon Web Services (AWS) accounts for Bring Your Own Key (BYOK) and External Key Store (XKS)

  • Microsoft Azure subscriptions for BYOK

  • Google Cloud Platform (GCP) projects for External Key Manager (EKM) and BYOK.
    For more information, refer to the User’s Guide: Usage Metrics.

2. Improvements

• Fortanix DSM now records changes to account and group-level Quorum policy definitions in the Audit Log, capturing both the updated policy and a readable summary of differences for improved auditability (JIRA: EXTREQ-1139).
  For more information, refer to the User's Guide: Logging.

• Fortanix DSM now records audit log events for deactivation of security objects that are being rotated (JIRA: EXTREQ-508).
  

• Fortanix DSM now enforces password history restrictions to enhance account security. Users cannot reuse any of their last four passwords, including the current one, when setting a new password (JIRA: PM-509).
  For more information, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS.

• Added tooltip displaying full object name for long names in MultiAssigner views on hover in Fortanix DSM, as long object names appear truncated in the list (JIRA: EXTREQ-1308).
  

• Updated the DSM UI notification message for a 404 error from Deleted [object] to Unknown [object] to more accurately reflect that the object may not be deleted, but simply inaccessible (JIRA: ROFR-5593).

3. Other Improvements

• The Fortanix DSM browser interface is now compliant with United States (US) Section 508 standards, allowing navigation and operation without a pointing device. This ensures that operators who are physically unable to use a pointing device can fully operate and use the product (JIRA: EXTREQ-1246).

• Added validation for unrecognized critical extensions when processing service and key attestation authority (KAA) certificates in CA-based Fortanix DSM plugins. Certificates with unknown critical extensions are now rejected (JIRA: PROD-9943). 

4. API Updates

• Updated GET /sys/v1/accounts/:acct_id/usage (Get Account Usage) API to include additional Cloud Data Control (CDC) related usage metrics per Fortanix DSM account (JIRA: PM-266):
  The following metrics are now reported:

  • Number of GCP cloud projects

  • Number of AWS accounts

  • Number of Azure subscriptions

  • Number of Google EKM projects

  • Number of AWS KMS XKS instances

• Added a new default field to the existing RestrictedDuration structure in the Fortanix DSM Key Metadata Policy to support setting a default expiry time in policies. This allows users to define default and/or maximum key expiry durations at the account or group policy level (JIRA: EXTREQ-887).
  This enhancement applies to the following APIs:

  • Create Account: POST /sys/v1/accounts

  • Update Account: PATCH /sys/v1/accounts/:acct_id

  • Create Group: POST /sys/v1/groups

  • Update Group: PATCH /sys/v1/groups/:group_id

• Added support for combining mutual TLS authentication (using Trusted CA or client certificates) with application-level authentication methods such as API Key, JWT, and others. This enhancement enables enforcement of multi-factor authentication for applications without affecting existing setups or those using only TLS-based authentication (JIRA: EXTREQ-1040).
  This enhancement applies to the following APIs:

  • Create App: POST /sys/v1/apps

  • Update App: PATCH /sys/v1/apps/:app_id

  • Get App(s): GET /sys/v1/apps, GET /sys/v1/apps/:app_id

  • Get App Credential: GET /sys/v1/apps/:app_id/credential

  • Reset Secret: POST /sys/v1/apps/:app_id/reset_secret

  • Authenticate App: POST /sys/v1/session/auth

• Added support for identifying irreversible tokenization keys in the Sobject API model using the following new fields (JIRA: EXTREQ-861):

  • original_key_ops: Specifies the key operations assigned at creation.

  • key_creation_method: Indicates how the key was created. For example, Generate, Import, Derive, and so on.

5. Integrations and Use Cases

• Added support for integrating Fortanix DSM with Microsoft Network Device Enrollment Service (NDES) (JIRA: PM-456).
  For more information, refer to Using Fortanix Data Security Manager with Microsoft Network Device Enrollment Service. 

6. Client Features and Bug Fixes

• Added support for importing and retrieving the keyrings to/from Fortanix DSM using the Sequoia DSM (sq-dsm) client (JIRA: PM-400).
  For more information, refer to Clients: Sequoia PGP.

• Added support for the KeyRoleType field within the Cryptographic Parameters attribute in the Fortanix Key Management Interoperability Protocol (KMIP) client (JIRA: PROD-9362).

• Added support for AuthenticatedEncryptionAdditionalData and AuthenticatedEncryptionTag in KMIP Encrypt and Decrypt operations (JIRA: PM-538).

• Added support for key wrapping in KMIP Register and Get operations using KeyWrappingData and KeyWrappingSpecification structures (JIRA: PM-428).

• Fixed the logic in the Fortanix DSM PKCS#11 client for sending a terminate signal to the session refresh loop of a specific HSM slot, which previously failed intermittently due to a race condition between the signal-issuing thread and the session refresh loop (JIRA: PROD-10348).

7. DSM Accelerator New Features

• Added support for Mutual TLS (mTLS)-based key exports in Fortanix DSM Accelerator Webservice, enabling key exports from Fortanix DSM using its certificate instead of client application credentials (JIRA: PM-523).
  For more information, refer to DSM Accelerator Webservice Developer Guide.

8. Bug Fixes

• Fixed a vulnerability in sudo reported as CVE-2025-32462 in Ubuntu 24.04 (JIRA: RODE-160). 

9. Known Issues

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname (JIRA: PROD-9542).

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod resulting in two certificate pairs which can lead to unexpected results (JIRA: PROD-9570).

• Deleting replica keys in groups with key history policies only results in a soft-delete of the keys (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
  Workaround: Set the retention period to 2 days or longer under Settings → LOG MANAGEMNET  → Retention period for Audit Logs to ensure recent audit log entries are visible.