[5.2] - August 11, 2025

Fortanix Data Security Manager (DSM) 5.2 comes with some general improvements and resolved issues.

This release is superseded by the September 22, 2025, release.

WARNING

• If you want to upgrade Fortanix DSM to version 5.2 from a version earlier than 4.36 patch 4, please contact the Fortanix Support team at your earliest to validate the upgrade path.

• Downgrade from 5.2 to any prior version is not supported due to Kubernetes and Kernel upgrades.

NOTE

• If you are using a custom sudo user, ensure that the default administrator user is enabled with root privileges before upgrading to Fortanix DSM version 5.2. The administrator user must be able to log in with a password and be part of the sudo group.

• During the upgrade, the /etc/sudoers file is overwritten, which can result in the loss of sudo access for the custom sudo user.

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.0 or later, then the HSM Gateway version must also be 5.0 or later. Similarly, if the HSM Gateway version is 5.0 or later, then your Fortanix DSM version must be 5.0 or later.

1. Improvements

• Added the setting Default log retention period for new accounts created on this cluster under Fortanix DSM System Administration → Settings → POLICIES, allowing system administrators to set the log retention period at the DSM cluster level (JIRA: ROFR-5612).

  

  For more information, refer to the Fortanix Data Security Manager - Sysadmin Settings - Policies.

• Removed hyphens from the Azure Key Version Number before displaying it in the Fortanix DSM user interface (UI) under the AZURE KEY DETAILS tab (JIRA: ROFR-5545). 

  

• New Google Cloud Platform (GCP) Cloud Key Management Service (KMS) Regions have been added as target to upload Customer Managed Keys to GCP KMS: Columbus (us-east5), Dallas (us-south1), Johannesburg (africa-south1), Madrid (europe-southwest1), Berlin (europe-west10), Turin (europe-west12), Milan (europe-west8), Paris (europe-west9), Doha (me-central1), Damman (me-central2), and Tel Aviv (me-west1) (JIRA: PM-547).

  

2. Other Improvements

• Updated the Fortanix DSM node join-policy to allow scalable platform support, enabling Azure DCv3 virtual machines (VMs) to join clusters previously restricted to DCv2 VMs. This only applies to customers who run Azure clusters with hardware attestation enabled (JIRA: PROD-10364).

• Google Cloud EKM connections can now be routed over a Private Connect path between the user’s GCP environment and Fortanix DSM SaaS (JIRA: PM-470). 
  For more information, refer to Fortanix Data Security Manager with Google Control Plane Using Virtual Private Cloud.

3. API Updates

• Added the new format_v2 model under FpeOptions for defining Format-Preserving Encryption (FPE) structures with enhanced validation and precision in tokenization (JIRA: PM-418 and PM-548).

  • The Generate a New Security Object API (POST /crypto/v1/keys) now supports this new model.

    For more information, refer to Security Object Tokenization Quickstart and Security Object Tokenization Examples.

• Added a new API endpoint GET /sys/v1/tls_certificates that returns the Subject Public Key Information (SPKI) from TLS certificates used in the Fortanix DSM cluster, enabling secure integration with Google Cloud External Key Manager (EKM) over a Virtual Private Cloud (VPC) connection (JIRA: PM-470).

4. Client Improvements

• Added support for publishing the Windows signed binary to the Chocolatey package manager in the Sequoia-PGP client (JIRA: PM-453).
  For more information, refer to Sequoia-PGP.

5. DSM Accelerator New Features and Improvements

• DSM Accelerator EKM:

  • Added Fortanix DSM Accelerator support for Extensible Key Management (EKM) client (JIRA: PM-443).
    For more information, refer to the following:

    • DSM Accelerator EKM

    • DSM Accelerator EKM Developer Guide

• DSM Accelerator Webservice:

  • Fortanix DSM Accelerator Webservice for Nitro with Fortanix Confidential Computing Manager (CCM) now automatically detects and applies newly renewed CCM certificates, eliminating the need for manual restarts (JIRA: PM-510).

  • Fixed an issue where Oracle TDE with Fortanix DSM Accelerator Webservice experienced database instance crashes due to PKCS#11 session expiration errors (JIRA: ES-540).

6. Quality Enhancements

• Upgraded libc6 version to 2.39-0ubuntu8.5 (JIRA: RODE-189).

• Upgraded Kernel to Linux version 6.8.0-71 (JIRA: RODE-173).

• Migrated the Fortanix DSM keepalived container from Ubuntu 20 to Ubuntu 24 (JIRA: RODE-83).

• Upgraded Kubernetes to version 1.32.5 (JIRA: PM-505). 
  For more information, refer to Fortanix Data Security Manager (Release 5.2) Kubernetes Version Upgrade to 1.32 K8s.

7. Bug Fixes

• Fixed an issue where the “Choose people” placeholder text was missing after adding a user from the list while configuring a Quorum approval policy (JIRA: ROFR-5565).

• Fixed an issue with regenerating an API key for a Fortanix DSM application using the REGENERATE button in the application's detailed view (JIRA: ES-542).

8. Known Issues

• Upgrading from Fortanix DSM 5.0 or later could cause package upload failures from the DSM UI, resulting in HTTP 400 or HTTP 500 errors (JIRA: ES-599).

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname (JIRA: PROD-9542).

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results (JIRA: RODE-97).

• Deleting replica keys in groups with key history policies only results in a soft-delete of the keys (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
  Workaround: Set the retention period to 2 days or longer under Settings→ LOG MANAGEMNET  → Retention periodfor Audit Logs to ensure recent audit log entries are visible.

• Unable to perform Kubernetes CA rotation successfully (JIRA: RODE-62).
  Workaround: To perform CA rotation in DSM 5.2, contact Fortanix Support team.

• After upgrading Fortanix DSM to version 5.0 or later, Network Time Protocol (NTP) checks in Sensu may fail even if NTP is correctly synchronized across the cluster (JIRA: RODE-168).

  NOTE

  Use the following command to override the alert:

  check-ntp.rb -u ok -w ${WARN_LEVEL} -c ${CRITICAL_LEVEL}" \

• When installing Fortanix DSM 5.2 or Fortanix DSM 5.4 software on VM-based Marketplace images (AWS, Azure, or VMware) in an air-gapped environment, the installation may fail. This issue occurs because the system contains a reference to the upstream Ubuntu repository file (JIRA: RODE-337).
  Workaround:

  • Fresh installation:

    1. Before creating a cluster:

       1. Move the upstream Ubuntu repository file: mv /etc/apt/sources.list.d/ubuntu.sources /tmp/.

       2. Run the package update command: apt-get update.

       3. Verify that no upstream Ubuntu repository references appear in the output.

    2. Proceed with cluster creation: sdkms-cluster create.

  • Upgrade from DSM 5.2 or 5.4:

    1. Before clicking Submit to start the upgrade:

       1. Move the upstream Ubuntu repository file: mv /etc/apt/sources.list.d/ubuntu.sources /tmp/.

       2. Run the package update command: apt-get update.

       3. Verify that no upstream Ubuntu repository references appear in the output.

    2. Click Submit to start the DSM upgrade.

9. Fortanix Data Security Manager Performance Statistics

NOTE

As part of this major release, the underlying operating system of Fortanix DSM has been upgraded from Ubuntu 20.04 to Ubuntu 24.04, which includes a significant Linux kernel update from version 5.4.0 to 6.8.0, along with multiple software package updates.

9.1 Series 2

9.2 Azure Standard_DC8_v2

9.3 Azure Standard_DC8s_v3

9.4 Series 2 JCE

9.5 Azure Standard DC8 JCE

10. Fortanix Data Security Manager Accelerator Performance Statistics

10.1 Runtime Environment

NOTE

The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

10.2 DSM Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

10.3 Additional Modes