---
title: "[5.2] - August 11, 2025"
slug: "5-2-august-11-2025"
updated: 2026-08-19T06:28:25Z
published: 2026-08-19T06:28:25Z
canonical: "support.fortanix.com/5-2-august-11-2025"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# [5.2] - August 11, 2025

Fortanix Data Security Manager (DSM) 5.2 comes with some general improvements and resolved issues.

This release is superseded by the [September 22, 2025](/v1/docs/5-2-patch-1-september-22-2025), release.

> [!WARNING]
> WARNING
> 
> - If you want to upgrade Fortanix DSM to version 5.2 from a version earlier than 4.36 patch 4, please contact the Fortanix Support team at your earliest to validate the upgrade path.
> - Downgrade from 5.2 to any prior version is not supported due to Kubernetes and Kernel upgrades.

> [!NOTE]
> NOTE
> 
> - If you are using a custom sudo user, ensure that the default **administrator** user is enabled with root privileges **before upgrading to Fortanix DSM version 5.2**. The **administrator** user must be able to log in with a password and be part of the sudo group.
> - During the upgrade, the `/etc/sudoers` file is overwritten, which can result in the loss of sudo access for the custom sudo user.
> - The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.
> - The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.
> - If your Fortanix DSM version is 5.0 or later, then the HSM Gateway version must also be 5.0 or later. Similarly, if the HSM Gateway version is 5.0 or later, then your Fortanix DSM version must be 5.0 or later.

## 1. Improvements

- Added the setting **Default log retention period for new accounts created on this cluster** under Fortanix DSM **System Administration** → **Settings** → **POLICIES**, allowing system administrators to set the log retention period at the DSM cluster level (**JIRA: ROFR-5612**).

![DSM_Setting Log Level.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39998228158100)

*For more information, refer to the* [*Fortanix Data Security Manager - Sysadmin Settings - Policies*](/v1/docs/fortanix-data-security-manager-sysadmin-settings-policies#25-default-log-retention-for-new-accounts).
- Removed hyphens from the **Azure Key Version Number** before displaying it in the Fortanix DSM user interface (UI) under the **AZURE KEY DETAILS** tab (**JIRA: ROFR-5545**).

![DSM_Azure Key Version Number.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39998219430804)
- New Google Cloud Platform (GCP) Cloud Key Management Service (KMS) Regions have been added as target to upload Customer Managed Keys to GCP KMS: Columbus (us-east5), Dallas (us-south1), Johannesburg (africa-south1), Madrid (europe-southwest1), Berlin (europe-west10), Turin (europe-west12), Milan (europe-west8), Paris (europe-west9), Doha (me-central1), Damman (me-central2), and Tel Aviv (me-west1) (**JIRA: PM-547**).

![DSM_Regions.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/39998228159636)

## 2. Other Improvements

- Updated the Fortanix DSM node join-policy to allow scalable platform support, enabling Azure DCv3 virtual machines (VMs) to join clusters previously restricted to DCv2 VMs. This only applies to customers who run Azure clusters with hardware attestation enabled (**JIRA: PROD-10364**).
- Google Cloud EKM connections can now be routed over a Private Connect path between the user’s GCP environment and Fortanix DSM SaaS (**JIRA: PM-470**). *For more information, refer to* [*Fortanix Data Security Manager with Google Control Plane Using Virtual Private Cloud*](/v1/docs/fortanix-dsm-with-google-control-plane-using-virtual-private-cloud).

## 3. API Updates

- Added the new `format_v2` model under `FpeOptions` for defining Format-Preserving Encryption (FPE) structures with enhanced validation and precision in tokenization (**JIRA: PM-418** and **PM-548**).
  - The **Generate a New Security Object** API (`POST /crypto/v1/keys`) now supports this new model.

*For more information, refer to* [*Security Object Tokenization Quickstart*](/v1/docs/fortanix-dsm-security-objects-tokenization-quickstart#32-create-aes-security-object-with-fpe-field) *and* [*Security Object Tokenization Examples*](/v1/docs/fortanix-dsm-security-objects-tokenization-examples).
- Added a new API endpoint `GET /sys/v1/tls_certificates` that returns the Subject Public Key Information (SPKI) from TLS certificates used in the Fortanix DSM cluster, enabling secure integration with Google Cloud External Key Manager (EKM) over a Virtual Private Cloud (VPC) connection (**JIRA: PM-470**).

## 4. Client Improvements

- Added support for publishing the Windows signed binary to the Chocolatey package manager in the Sequoia-PGP client (**JIRA: PM-453**). *For more information, refer to* [*Sequoia-PGP*](/v1/docs/sequoia-pgp-1)*.*

## 5. DSM Accelerator New Features and Improvements

- **DSM Accelerator EKM:**
  - Added Fortanix DSM Accelerator support for Extensible Key Management (EKM) client (**JIRA: PM-443**). *For more information, refer to the following:*
    - [*DSM Accelerator EKM*](/v1/docs/dsm-accelerator-ekm-1)
    - [*DSM Accelerator EKM Developer Guide*](/v1/docs/dsm-accelerator-ekm-developer-guide)
- **DSM Accelerator Webservice:**
  - Fortanix DSM Accelerator Webservice for Nitro with Fortanix Confidential Computing Manager (CCM) now automatically detects and applies newly renewed CCM certificates, eliminating the need for manual restarts (**JIRA: PM-510**).
  - Fixed an issue where Oracle TDE with Fortanix DSM Accelerator Webservice experienced database instance crashes due to PKCS#11 session expiration errors (**JIRA: ES-540**).

## 6. Quality Enhancements

- Upgraded `libc6` version to 2.39-0ubuntu8.5 (**JIRA: RODE-189**).
- Upgraded Kernel to Linux version 6.8.0-71 (**JIRA: RODE-173**).
- Migrated the Fortanix DSM keepalived container from Ubuntu 20 to Ubuntu 24 (**JIRA: RODE-83**).
- Upgraded Kubernetes to version 1.32.5 (**JIRA: PM-505**). *For more information, refer to* [*Fortanix Data Security Manager (Release 5.2) Kubernetes Version Upgrade to 1.32 K8s*](/v1/docs/fortanix-data-security-manager-release-52-kubernetes-version-upgrade-to-132-k8s)*.*

## 7. Bug Fixes

- Fixed an issue where the “Choose people” placeholder text was missing after adding a user from the list while configuring a Quorum approval policy (**JIRA: ROFR-5565**).
- Fixed an issue with regenerating an API key for a Fortanix DSM application using the **REGENERATE** button in the application's detailed view **(JIRA: ES-542)**.

## 8. Known Issues

- Upgrading from Fortanix DSM 5.0 or later could cause package upload failures from the DSM UI, resulting in HTTP 400 or HTTP 500 errors (**JIRA: ES-599**).
- The **COPY KEY** dialog box does not filter the HSM/External KMS groups as expected when **Import key to HSM/External KMS** check box is selected, if there are more than 1,000 groups in the account **(JIRA: ROFR-5167)**.
- Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation **(JIRA: PROD-9409)**. **Workaround**: To delete the invited user, contact Fortanix Support or perform the following steps:
  - If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:
    - Change the user's account role to "Account Member".
    - Remove the group memberships one by one using the user interface.
    - Delete the user.
- The `sudo get_csrs --rotate` command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname **(JIRA: PROD-9542)**.
- When you run `sudo get_csrs --rotate` command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results **(JIRA: RODE-97)**.
- Deleting replica keys in groups with key history policies only results in a soft-delete of the keys **(JIRA: PROD-9925)**. **Workaround**: Users should avoid deleting keys that are associated with a key-undo policy.
- The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (**JIRA: PROD-10441**). **Workaround**: Set the retention period to 2 days or longer under **Settings→ LOG MANAGEMNET → Retention periodfor Audit Logs** to ensure recent audit log entries are visible.
- Unable to perform Kubernetes CA rotation successfully (**JIRA: RODE-62**). **Workaround**: To perform CA rotation in DSM 5.2, contact Fortanix Support team.
- After upgrading Fortanix DSM to version 5.0 or later, Network Time Protocol (NTP) checks in Sensu may fail even if NTP is correctly synchronized across the cluster (**JIRA: RODE-168**).

> [!NOTE]
> NOTE
> 
> Use the following command to override the alert:
> 
> ```plaintext
> check-ntp.rb -u ok -w ${WARN_LEVEL} -c ${CRITICAL_LEVEL}" \
> ```

- When installing **Fortanix DSM 5.2** or **Fortanix DSM 5.4 software** on VM-based Marketplace images (AWS, Azure, or VMware) in an air-gapped environment, the installation may fail. This issue occurs because the system contains a reference to the upstream Ubuntu repository file (**JIRA: RODE-337**). **Workaround**:
  - **Fresh installation:**
    1. Before creating a cluster:
      1. Move the upstream Ubuntu repository file: `mv /etc/apt/sources.list.d/ubuntu.sources /tmp/`.
      2. Run the package update command: `apt-get update`.
      3. Verify that no upstream Ubuntu repository references appear in the output.
    2. Proceed with cluster creation: `sdkms-cluster create`.
  - **Upgrade from DSM 5.2 or 5.4:**
    1. Before clicking **Submit** to start the upgrade:
      1. Move the upstream Ubuntu repository file: `mv /etc/apt/sources.list.d/ubuntu.sources /tmp/`.
      2. Run the package update command: `apt-get update`.
      3. Verify that no upstream Ubuntu repository references appear in the output.
    2. Click **Submit** to start the DSM upgrade.

## 9. Fortanix Data Security Manager Performance Statistics

> [!NOTE]
> NOTE
> 
> As part of this major release, the underlying operating system of Fortanix DSM has been upgraded from Ubuntu 20.04 to Ubuntu 24.04, which includes a significant Linux kernel update from version 5.4.0 to 6.8.0, along with multiple software package updates.

### 9.1 Series 2

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,754/6,045 |
| AES 256: GCM Encryption/Decryption | 6,029/5,934 |
| AES 256: FPE Encryption/Decryption | 4,676/4,712 |
| AES 256 Key Generation | 1,175 |
|  |  |
| RSA 2048 Encryption/Decryption | 5,528/2,007 |
| RSA 2048 Key Generation | 43 |
| RSA 2048 Sign/Verify | 2,011/5,558 |
| RSA 4096 Sign/Verify | 628/4,931 |
|  |  |
| EC NISTP256 Key Generation | 939 |
| EC NISTP256 Sign/Verify | 2,640/1,739 |
| EC secP256K1 Key Generation | 846 |
| EC secP256K1 Sign/Verify | 1,976/1,211 |
|  |  |
| Kyber ML-KEM Encapsulation | 1,117 |
| Kyber ML-KEM Decapsulation | 1,113 |
|  |  |
| LMS Key (Height, Node) |  |
| L1 5, Node 24 | 174 |
| L1 5, Node 32 | 139 |
| L1 10, Node 24 | 6.01 |
| L1 10, Node 32 | 4.84 |
|  |  |
| BIP32 Key Derive as Transient Hardened Child Key | 901 |
| BIP32 Sign | 901 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,377 (invocations/second) |

---

### 9.2 Azure Standard_DC8_v2

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8_v2] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 3,549/3,577 |
| AES 256: GCM Encryption/Decryption | 3,575/3,547 |
| AES 256: FPE Encryption/Decryption | 3,091/3,089 |
| AES 256 Key Generation | 948 |
|  |  |
| RSA 2048 Encryption/Decryption | 3,437/1,644 |
| RSA 2048 Key Generation | 38 |
| RSA 2048 Sign/Verify | 1,653/3,541 |
| RSA 4096 Sign/Verify | 539/3,200 |
|  |  |
| EC NISTP256 Key Generation | 803 |
| EC NISTP256 Sign/Verify | 2,048/1,463 |
| EC secP256K1 Key Generation | 741 |
| EC secP256K1 Sign/Verify | 1,633/1,072 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,392 (invocations/second) |

---

### 9.3 Azure Standard_DC8s_v3

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8s_v3] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 4,498/4,460 |
| AES 256: GCM Encryption/Decryption | 4530/4,490 |
| AES 256: FPE Encryption/Decryption | 3,798/3,798 |
| AES 256 Key Generation | 1,478 |
|  |  |
| RSA 2048 Encryption/Decryption | 4,332/1,868 |
| RSA 2048 Key Generation | 62 |
| RSA 2048 Sign/Verify | 1,877/4,418 |
| RSA 4096 Sign/Verify | 582/4,054 |
|  |  |
| EC NISTP256 Key Generation | 1,135 |
| EC NISTP256 Sign/Verify | 2,267/1,508 |
| EC secP256K1 Key Generation | 959 |
| EC secP256K1 Sign/Verify | 1,687/1,046 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 3,681 (invocations/second) |

---

### 9.4 Series 2 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 5,504/5,649 |
| AES 256 Key Generation | 1,179 |
|  |  |
| RSA 2048 Key Generation | 41 |
| RSA 2048 Sign/Verify | 1,530/2,831 |
| RSA 4096 Sign/Verify | 587/2,696 |
|  |  |
| EC NISTP256 Key Generation | 961 |
| EC NISTP256 Sign/Verify | 1,840/1,480 |
| EC secP256K1 Key Generation | 845 |
| EC secP256K1 Sign/Verify | 1,497/1,029 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,393 (invocations/second) |

---

### 9.5 Azure Standard DC8 JCE

| **Key Types and Operations** | **Throughput (Operations/second on a 3-node [Standard_DC8 JCE] cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 3,542/3,504 |
| AES 256 Key Generation | 969 |
|  |  |
| RSA 2048 Key Generation | 37 |
| RSA 2048 Sign/Verify | 1,173/1,842 |
| RSA 4096 Sign/Verify | 480/1,785 |
|  |  |
| EC NISTP256 Key Generation | 817 |
| EC NISTP256 Sign/Verify | 1,348/1,091 |
| EC secP256K1 Key Generation | 735 |
| EC secP256K1 Sign/Verify | 1,170/857 |
|  |  |
| Data Security Manager Plugin (Hello world plugin) | 2,403 (invocations/second) |

---

## 10. Fortanix Data Security Manager Accelerator Performance Statistics

### 10.1 Runtime Environment

> [!NOTE]
> NOTE
> 
> The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.
> 
> DSM Accelerator was run in the runtime environment listed below for performance testing.

| **Item** | **Specification** |
| --- | --- |
| Number of Cores | 4 |
| CPU | Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz |
| RAM | 2 GiB |
| VM Type | Standard D4ds v4 Azure VM |
| Docker Runtime Configuration | `sudo docker run -d --network host --memory=1g --memory-swap=2g --log-driver json-file --log-opt max-size=100m` |

---

### 10.2 DSM Accelerator Webservice

> [!NOTE]
> NOTE
> 
> The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBC Encryption/Decryption | 20,695/20,439 |
| AES 256: GCM Encryption/Decryption | 21,773/21,604 |
| AES 256: FPE Encryption/Decryption | 9,448/9,406 |

---

### 10.3 Additional Modes

| **Key Types and Operations** | **Throughput (Operations/second on a 1-node cluster re-using a single TLS session)** |
| --- | --- |
| AES 256: CBCNOPAD Encryption/Decryption | 21,770/21,684 |
| AES 256: CFB Encryption/Decryption | 21,599/21,312 |
| AES 256: CTR Encryption/Decryption | 21,750/21,192 |
| AES 256: OFB Encryption/Decryption | 21,826/21,647 |
| AES 256: CCM Encryption/Decryption | 21,465/21,079 |

---

## 11. Installation

To install the DSM Runtime Encryption® SGX (on-prem/Azure) and Software (AWS/Azure) packages, [Download Here](/v1/docs/dsm-installation-packages-on-prem).