--- title: "[5.4] Patch 3 - February 27, 2026" slug: "5-5-january-23-2026" updated: 2026-08-19T05:46:58Z published: 2026-08-19T05:46:58Z canonical: "support.fortanix.com/5-5-january-23-2026" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # [5.4] Patch 3 - February 27, 2026 Fortanix Data Security Manager (DSM) SaaS 5.5 includes some exciting new features and general improvements. > [!NOTE] > NOTE > > This release is for **SaaS only** and is not available for on-premises installations. Updates in this release will be part of a future on-premises release. ## 1. New Features - Fortanix DSM now supports a guided Tokenization Workflow that allows users to create groups, applications, and tokenization security objects in a single, end-to-end flow from the DSM user interface (UI) **(JIRA: PM-460)**. ![Get-Started-Screen - Copy.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/45553299876884) *For more information, refer to* [*Fortanix Data Security Manager - Workflows Tokenization*](/v1/docs/fortanix-data-security-manager-workflows)*.* - Fortanix DSM now provides a command-line tool ([DSM Audit Log Export Tool](/v1/docs/dsm-audit-log-export-tool)) that allows DSM account administrators to export arbitrarily large volumes of historical audit log entries from a DSM cluster to a local file on the client host, supporting migration to external log management systems **(JIRA: PM-610)**. ## 2. Improvements - Fortanix DSM can now generate Elliptic Curve (EC) keys **Ed448** through the DSM UI **(JIRA: PM-452)**. ![Screenshot (2633).png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/45553299880852) - Added toast notifications in the Fortanix DSM UI to display appropriate error messages when users without the required add permissions attempt to create custom group roles, apps, security objects, or plugins **(JIRA: ES-565)**. ![5.5-Error.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/45577995617300) - Modernized the Fortanix DSM UI to improve visual consistency with Fortanix Armor and enhance usability. As part of this update, the legacy “**+**” icon next to page titles has been replaced with clearly labeled action buttons (for example, **ADD GROUP**, **ADD APP**, **ADD SECURITY OBJECT**, **ADD USER**, and **ADD PLUGIN**) positioned in the top-right of their respective pages, making primary actions more discoverable and consistent across the product **(JIRA: ROFR-5665)**. ![5.5-Addapp.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/45553696184212) ![5.5-Addgroup.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/45553700937364) ## 3. Other Improvements - Added pagination support for vaults and/or keys in the Fortanix DSM UI for the Oracle Cloud Infrastructure (OCI) Bring Your Own Key (BYOK) integration **(JIRA: PROD-10762)**. ## 4. API Updates - Introduced the REST API `GET /sys/v1/tls_public_keys`, which returns Subject Public Key Information (SPKI) values for TLS certificates using updated response models. The existing `GET /sys/v1/tls_certificates` endpoint has been deprecated to better align API naming with its actual behavior; however, it remains supported for backward compatibility **(JIRA: PROD-10781)**. *For more information, refer to* [*Fortanix Data Security Manager with Google Cloud EKM Interface Using Virtual Private Cloud*](/v1/docs/fortanix-dsm-with-google-cloud-ekm-interface-using-virtual-private-cloud#53-configure-gcp-ekm-connection)*.* ## 5. Integrations and Use Cases - Added support for using Fortanix DSM with Oracle Transparent Data Encryption (TDE) in Oracle Exadata Cloud@Customer (ExaCC) environments **(JIRA: IX-673)**. *For more information, refer to* [*Using Fortanix Data Security Manager with Oracle TDE for Exadata Cloud@Customer (ExaCC)*](/v1/docs/using-fortanix-dsm-with-oracle-tde-for-exadata-cloud-customer-exacc). ## 6. Client New Features and Improvements - Added server certificate revocation checks to the Fortanix PKCS#11 library when connecting to Fortanix DSM **(JIRA: EXTREQ-1377)**. *For more information, refer to* [*Clients: PKCS#11 Library*](/v1/docs/fortanix-dsm-clients-pkcs11-library)*.* - Added server certificate revocation checks to the Fortanix CNG Provider when connecting to Fortanix DSM **(JIRA: EXTREQ-1378)**. *For more information, refer to* [*Clients: Microsoft CNG Key Storage Provider*](/v1/docs/fortanix-dsm-clients-microsoft-cng-key-storage-provider)*.* - Added server certificate revocation checks to the Fortanix EKM Provider when connecting to Fortanix DSM **(JIRA: EXTREQ-1379)**. *For more information, refer to* [*Clients: Microsoft CNG Key Storage Provider*](/v1/docs/fortanix-dsm-clients-microsoft-cng-key-storage-provider)*.* - Updated the following in the Fortanix PKCS#11 library **(JIRA: PM-478)**: - `CKA_START_DATE` and `CKA_END_DATE` attributes are mapped to the key activation date and deactivation date. These attributes can be retrieved using `C_GetAttributeValue` but cannot be modified using `C_SetAttributeValue`. - The `CKA_CHECK_VALUE` attribute is mapped to the Key Checksum Value (KCV) for symmetric keys and can be retrieved using `C_GetAttributeValue`. - Existing key operations can be removed after key creation through PKCS#11 using `C_SetAttributeValue`. - Fixed an issue where PKCS#11 operations against the Hardware Security Module (HSM) were failing with the `CKR_KEY_FUNCTION_NOT_PERMITTED (104)` error **(JIRA: ES-585)**. ## 7. DSM Accelerator New Features and Improvements - **DSM Accelerator Webservice:** - Added support for PKCS#8 password-protected private keys in Fortanix DSM Accelerator Webservice TLS server configuration, enabling secure TLS setup with encrypted keys using password or flag-based configuration **(JIRA: EXTREQ-1467)**. *For more information, refer to the* [*DSM Accelerator Webservice Developer Guide*](/v1/docs/dsm-accelerator-webservice-developer-guide)*.* - Added certificate-based client application (app) authentication for Fortanix DSM Accelerator Webservice, allowing Fortanix DSM apps to authenticate using a client certificate instead of an API key **(JIRA: EXTREQ-1541)**. *For more information, refer to the* [*DSM Accelerator Webservice Developer Guide*](/v1/docs/dsm-accelerator-webservice-developer-guide)*.* - Added secure Database Master Key (DMK) caching for Oracle Transparent Data Encryption (TDE), integrating with Fortanix DSM Accelerator Webservice to improve resiliency and performance **(JIRA: PM-519)**. - **DSM Accelerator PKCS#11:** - Updated Fortanix DSM Accelerator PKCS#11 to achieve feature parity with Fortanix DSM Accelerator Webservice, including key algorithm and mode support, key caching, RSA wrap or unwrap operations, policy awareness, client certificate–based authentication, and cached key prioritization **(JIRA: PM-579)**. *For more information, refer to the* [*DSM Accelerator PKCS#11 Developer Guide*](/v1/docs/dsm-accelerator-pkcs11-developer-guide)*.* ## 8. Bug Fixes - Fixed an issue where the **Rotate Key** operation for a security object did not generate a quorum approval request when the requester was not part of the quorum reviewer list, resulting in an “Operation requires approval” error **(JIRA: ES-575)**. - Fixed an issue in the OAuth consent screen UI where group entries were misaligned and the **Set a group as a “Default” Group** section appeared incorrectly positioned, resulting in inconsistent row sizes **(JIRA: ES-568)**. ## 9. Known Issues - A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account **(JIRA: ROFR-4998).** **Workaround:** The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account. - The **COPY KEY** dialog box does not filter the HSM/External KMS groups as expected when **Import key to HSM/External KMS** check box is selected, if there are more than 1,000 groups in the account **(JIRA: ROFR-5167)**. - Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation **(JIRA: PROD-9409)**. **Workaround**: To delete the invited user, contact Fortanix Support or perform the following steps: - If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user: - Change the user's account role to "Account Member". - Remove the group memberships one by one using the user interface. - Delete the user. - Deleting replica keys in groups with key history policies only results in a soft-delete of the keys **(JIRA: PROD-9925)**. **Workaround**: Users should avoid deleting keys that are associated with a key-undo policy. - The **Audit Log** page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day **(JIRA: PROD-10441)**. **Workaround**: Set the retention period to 2 days or longer under **Settings → LOG MANAGEMNET → Retention period for Audit Logs** to ensure recent audit log entries are visible.