Fortanix Data Security Manager (DSM) SaaS 5.5 includes some exciting new features and general improvements.
NOTE
This release is for SaaS only and is not available for on-premises installations. Updates in this release will be part of a future on-premises release.
1. New Features
Fortanix DSM now supports a guided Tokenization Workflow that allows users to create groups, applications, and tokenization security objects in a single, end-to-end flow from the DSM user interface (UI) (JIRA: PM-460).
For more information, refer to Fortanix Data Security Manager - Workflows Tokenization.
Fortanix DSM now provides a command-line tool (DSM Audit Log Export Tool) that allows DSM account administrators to export arbitrarily large volumes of historical audit log entries from a DSM cluster to a local file on the client host, supporting migration to external log management systems (JIRA: PM-610).
2. Improvements
Fortanix DSM can now generate Elliptic Curve (EC) keys Ed448 through the DSM UI (JIRA: PM-452).
Added toast notifications in the Fortanix DSM UI to display appropriate error messages when users without the required add permissions attempt to create custom group roles, apps, security objects, or plugins (JIRA: ES-565).
Modernized the Fortanix DSM UI to improve visual consistency with Fortanix Armor and enhance usability. As part of this update, the legacy “+” icon next to page titles has been replaced with clearly labeled action buttons (for example, ADD GROUP, ADD APP, ADD SECURITY OBJECT, ADD USER, and ADD PLUGIN) positioned in the top-right of their respective pages, making primary actions more discoverable and consistent across the product (JIRA: ROFR-5665).
3. Other Improvements
Added pagination support for vaults and/or keys in the Fortanix DSM UI for the Oracle Cloud Infrastructure (OCI) Bring Your Own Key (BYOK) integration (JIRA: PROD-10762).
4. API Updates
Introduced the REST API
GET /sys/v1/tls_public_keys, which returns Subject Public Key Information (SPKI) values for TLS certificates using updated response models.The existing
GET /sys/v1/tls_certificatesendpoint has been deprecated to better align API naming with its actual behavior; however, it remains supported for backward compatibility (JIRA: PROD-10781).For more information, refer to Fortanix Data Security Manager with Google Cloud EKM Interface Using Virtual Private Cloud.
5. Integrations and Use Cases
Added support for using Fortanix DSM with Oracle Transparent Data Encryption (TDE) in Oracle Exadata Cloud@Customer (ExaCC) environments (JIRA: IX-673).
For more information, refer to Using Fortanix Data Security Manager with Oracle TDE for Exadata Cloud@Customer (ExaCC).
6. Client New Features and Improvements
Added server certificate revocation checks to the Fortanix PKCS#11 library when connecting to Fortanix DSM (JIRA: EXTREQ-1377).
For more information, refer to Clients: PKCS#11 Library.
Added server certificate revocation checks to the Fortanix CNG Provider when connecting to Fortanix DSM (JIRA: EXTREQ-1378).
For more information, refer to Clients: Microsoft CNG Key Storage Provider.
Added server certificate revocation checks to the Fortanix EKM Provider when connecting to Fortanix DSM (JIRA: EXTREQ-1379).
For more information, refer to Clients: Microsoft CNG Key Storage Provider.
Updated the following in the Fortanix PKCS#11 library (JIRA: PM-478):
CKA_START_DATEandCKA_END_DATEattributes are mapped to the key activation date and deactivation date. These attributes can be retrieved usingC_GetAttributeValuebut cannot be modified usingC_SetAttributeValue.The
CKA_CHECK_VALUEattribute is mapped to the Key Checksum Value (KCV) for symmetric keys and can be retrieved usingC_GetAttributeValue.Existing key operations can be removed after key creation through PKCS#11 using
C_SetAttributeValue.
Fixed an issue where PKCS#11 operations against the Hardware Security Module (HSM) were failing with the
CKR_KEY_FUNCTION_NOT_PERMITTED (104)error (JIRA: ES-585).
7. DSM Accelerator New Features and Improvements
DSM Accelerator Webservice:
Added support for PKCS#8 password-protected private keys in Fortanix DSM Accelerator Webservice TLS server configuration, enabling secure TLS setup with encrypted keys using password or flag-based configuration (JIRA: EXTREQ-1467).
For more information, refer to the DSM Accelerator Webservice Developer Guide.
Added certificate-based client application (app) authentication for Fortanix DSM Accelerator Webservice, allowing Fortanix DSM apps to authenticate using a client certificate instead of an API key (JIRA: EXTREQ-1541).
For more information, refer to the DSM Accelerator Webservice Developer Guide.
Added secure Database Master Key (DMK) caching for Oracle Transparent Data Encryption (TDE), integrating with Fortanix DSM Accelerator Webservice to improve resiliency and performance (JIRA: PM-519).
DSM Accelerator PKCS#11:
Updated Fortanix DSM Accelerator PKCS#11 to achieve feature parity with Fortanix DSM Accelerator Webservice, including key algorithm and mode support, key caching, RSA wrap or unwrap operations, policy awareness, client certificate–based authentication, and cached key prioritization (JIRA: PM-579).
For more information, refer to the DSM Accelerator PKCS#11 Developer Guide.
8. Bug Fixes
Fixed an issue where the Rotate Key operation for a security object did not generate a quorum approval request when the requester was not part of the quorum reviewer list, resulting in an “Operation requires approval” error (JIRA: ES-575).
Fixed an issue in the OAuth consent screen UI where group entries were misaligned and the Set a group as a “Default” Group section appeared incorrectly positioned, resulting in inconsistent row sizes (JIRA: ES-568).
9. Known Issues
A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).
Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.
The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).
Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:
If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:
Change the user's account role to "Account Member".
Remove the group memberships one by one using the user interface.
Delete the user.
Deleting replica keys in groups with key history policies only results in a soft-delete of the keys (JIRA: PROD-9925).
Workaround: Users should avoid deleting keys that are associated with a key-undo policy.
The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
Workaround: Set the retention period to 2 days or longer under Settings → LOG MANAGEMNET → Retention period for Audit Logs to ensure recent audit log entries are visible.