--- title: "[5.1] - July 15, 2025" slug: "5-1-july-15-2025" updated: 2026-08-19T06:28:30Z published: 2026-08-19T06:28:30Z canonical: "support.fortanix.com/5-1-july-15-2025" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # [5.1] - July 15, 2025 Fortanix Data Security Manager (DSM) SaaS 5.1 comes with some exciting new features, general improvements, and resolved issues. > [!NOTE] > NOTE > > This release is for **SaaS only** and is not available for on-premises installations. Updates in this release will be part of a future on-premises release. ## 1. New Features - Fortanix DSM now supports the following new features for Key metadata policy **(JIRA: EXTREQ-887)**: - Defining an account-level Key metadata policy that allows setting default and maximum key expiry values in the policy definition. ![Screenshot (1830).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084507626516)*For more information, refer to the* [*User’s Guide: Account Key Metadata Policy*](/v1/docs/fortanix-dsm-account-key-metadata-policy)*.* - Setting default key expiry in the group-level Key metadata policy definition. ![Screenshot (1831).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084533538068)*For more information, refer to the* [*User’s Guide: Group Key Metadata Policy*](/v1/docs/fortanix-dsm-key-metadata-policy)*.* - Fortanix DSM now supports requiring a DSM application to authenticate using both a client TLS (Transport Layer Security) certificate and an in-band authentication method (such as an API key, JSON Web Token, External Directory and AWS IAM), providing strong multi-factor authentication through the DSM user interface **(JIRA: EXTREQ-1040)**. ![Screenshot (1827).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084533539732)*For more information, refer to the* [*User's Guide: Authentication*](/v1/docs/dsm-authentication#40-application-authentication)*.* - Fortanix DSM now supports a new key type for Irreversible Tokenization to allow secure format-preserving tokenization with no decryption or detokenization capabilities **(JIRA: EXTREQ-861)**. ![Screenshot (1832).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084507631508)*For more information, refer to the* [*User’s Guide: Tokenization*](/v1/docs/fortanix-dsm-security-objects-tokenization)*.* - Fortanix DSM Dashboard now displays the total number of configured Cloud Data Control (CDC) connections in a Fortanix DSM account **(JIRA: PM-266)**. It includes the number of: - Amazon Web Services (AWS) accounts for Bring Your Own Key (BYOK) and External Key Store (XKS) - Microsoft Azure subscriptions for BYOK - Google Cloud Platform (GCP) projects for External Key Manager (EKM) and BYOK. ![Screenshot (1833).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084533543572)*For more information, refer to the* [*User’s Guide: Usage Metrics*](/v1/docs/fortanix-dsm-usage-metrics)*.* ## 2. Improvements - Fortanix DSM now records changes to account and group-level Quorum policy definitions in the Audit Log, capturing both the updated policy and a readable summary of differences for improved auditability **(JIRA: EXTREQ-1139)**. ![QP-Update.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084507632660)*For more information, refer to the* [*User's Guide: Logging*](/v1/docs/fortanix-dsm-logging)*.* - Fortanix DSM now records audit log events for deactivation of security objects that are being rotated **(JIRA: EXTREQ-508)**. ![QP-deactivate.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084533545876) - Fortanix DSM now enforces password history restrictions to enhance account security. Users cannot reuse any of their last four passwords, including the current one, when setting a new password ***(JIRA: PM-509)****.* *![Screenshot (1838).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084533547028)For more information, refer to the* [*User's Guide: Sign Up for Fortanix Data Security Manager SaaS*](/v1/docs/sign-up-for-fortanix-data-security-manager-saas#32-resetting-your-forgotten-password)*.* - Added tooltip displaying full object name for long names in MultiAssigner views on hover in Fortanix DSM, as long object names appear truncated in the list **(JIRA: EXTREQ-1308)**. ![Screenshot (1885).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39084507637396) - Updated the DSM UI notification message for a 404 error from Deleted [object] to Unknown [object] to more accurately reflect that the object may not be deleted, but simply inaccessible **(JIRA: ROFR-5593)**. ## 3. Other Improvements - The Fortanix DSM browser interface is now compliant with United States (US) Section 508 standards, allowing navigation and operation without a pointing device. This ensures that operators who are physically unable to use a pointing device can fully operate and use the product **(JIRA: EXTREQ-1246)**. - Added validation for unrecognized critical extensions when processing service and key attestation authority (KAA) certificates in CA-based Fortanix DSM plugins. Certificates with unknown critical extensions are now rejected **(JIRA: PROD-9943)**. ## 4. API Updates - Updated `GET /sys/v1/accounts/:acct_id/usage` (Get Account Usage) API to include additional Cloud Data Control (CDC) related usage metrics per Fortanix DSM account **(JIRA: PM-266)**: The following metrics are now reported: - Number of GCP cloud projects - Number of AWS accounts - Number of Azure subscriptions - Number of Google EKM projects - Number of AWS KMS XKS instances - Added a new `default` field to the existing `RestrictedDuration` structure in the Fortanix DSM Key Metadata Policy to support setting a default expiry time in policies. This allows users to define default and/or maximum key expiry durations at the account or group policy level **(JIRA: EXTREQ-887)**. This enhancement applies to the following APIs: - Create Account: `POST /sys/v1/accounts` - Update Account: `PATCH /sys/v1/accounts/:acct_id` - Create Group: `POST /sys/v1/groups` - Update Group: `PATCH /sys/v1/groups/:group_id` - Added support for combining mutual TLS authentication (using Trusted CA or client certificates) with application-level authentication methods such as API Key, JWT, and others. This enhancement enables enforcement of multi-factor authentication for applications without affecting existing setups or those using only TLS-based authentication **(JIRA: EXTREQ-1040)**. This enhancement applies to the following APIs: - Create App: `POST /sys/v1/apps` - Update App: `PATCH /sys/v1/apps/:app_id` - Get App(s): `GET /sys/v1/apps, GET /sys/v1/apps/:app_id` - Get App Credential: `GET /sys/v1/apps/:app_id/credential` - Reset Secret: `POST /sys/v1/apps/:app_id/reset_secret` - Authenticate App: `POST /sys/v1/session/auth` - Added support for identifying irreversible tokenization keys in the `Sobject` API model using the following new fields (**JIRA: EXTREQ-861**): - `original_key_ops`: Specifies the key operations assigned at creation. - `key_creation_method`: Indicates how the key was created. For example, `Generate`, `Import`, `Derive`, and so on. ## 5. Integrations and Use Cases - Added support for integrating Fortanix DSM with Microsoft Network Device Enrollment Service (NDES) **(JIRA: PM-456)**. *For more information, refer to* [*Using Fortanix Data Security Manager with Microsoft Network Device Enrollment Service*](/v1/docs/fortanix-dsm-with-microsoft-network-device-enrollment-service)*.* ## 6. Client Features and Bug Fixes - Added support for importing and retrieving the keyrings to/from Fortanix DSM using the Sequoia DSM (sq-dsm) client (**JIRA: PM-400**). *For more information, refer to* [*Clients: Sequoia PGP*](/v1/docs/fortanix-dsm-clients-sequoia-pgp#55-example-usage-import-or-retrieve-keyrings-to-fortanix-dsm)*.* - Added support for the `KeyRoleType` field within the `Cryptographic Parameters` attribute in the Fortanix Key Management Interoperability Protocol (KMIP) client **(JIRA: PROD-9362)**. - Added support for `AuthenticatedEncryptionAdditionalData` and `AuthenticatedEncryptionTag` in KMIP **Encrypt** and **Decrypt** operations **(JIRA: PM-538)**. - Added support for key wrapping in KMIP **Register** and **Get** operations using `KeyWrappingData` and `KeyWrappingSpecification` structures **(JIRA: PM-428)**. - Fixed the logic in the Fortanix DSM PKCS#11 client for sending a terminate signal to the session refresh loop of a specific HSM slot, which previously failed intermittently due to a race condition between the signal-issuing thread and the session refresh loop (**JIRA: PROD-10348**). ## 7. DSM Accelerator New Features - Added support for Mutual TLS (mTLS)-based key exports in Fortanix DSM Accelerator Webservice, enabling key exports from Fortanix DSM using its certificate instead of client application credentials **(JIRA: PM-523)**. *For more information, refer to* [*DSM Accelerator Webservice Developer Guide*](/v1/docs/dsm-accelerator-webservice-developer-guide)*.* ## 8. Bug Fixes - Fixed a vulnerability in `sudo` reported as [CVE-2025-32462](https://ubuntu.com/security/CVE-2025-32462) in Ubuntu 24.04 **(JIRA: RODE-160)**. ## 9. Known Issues - The **COPY KEY** dialog box does not filter the HSM/External KMS groups as expected when **Import key to HSM/External KMS** check box is selected, if there are more than 1,000 groups in the account **(JIRA: ROFR-5167)**. - Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation **(JIRA: PROD-9409)**. **Workaround**: To delete the invited user, contact Fortanix Support or perform the following steps: - If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user: - Change the user's account role to "Account Member". - Remove the group memberships one by one using the user interface. - Delete the user. - The `sudo get_csrs --rotate` command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname **(JIRA: PROD-9542)**. - When you run `sudo get_csrs --rotate` command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod resulting in two certificate pairs which can lead to unexpected results **(JIRA: PROD-9570)**. - Deleting replica keys in groups with key history policies only results in a soft-delete of the keys **(JIRA: PROD-9925)**. **Workaround**: Users should avoid deleting keys that are associated with a key-undo policy. - The **Audit Log** page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (**JIRA: PROD-10441**). **Workaround**: Set the retention period to 2 days or longer under **Settings → LOG MANAGEMNET → Retention period for Audit Logs** to ensure recent audit log entries are visible.