[5.6] DSM - February 26, 2026

Fortanix Data Security Manager (DSM) 5.6 comes with new features, general improvements, and resolved issues.

This release is superseded by the April 15, 2026, release.

WARNING

• If you want to upgrade Fortanix DSM to version 5.6, your current DSM version must be at least 5.2 Patch 2*.

• Downgrade from 5.6 to any prior version is not supported due to Kernel upgrades.

• Upgrading Fortanix DSM to version 5.6 includes an underlying Kubernetes upgrade to version 1.34. As a result, the upgrade process may take longer than usual.

*The minimum required version is specific to your current major.minor version. You must first upgrade to the required patch level within your current version before proceeding to version 5.6.

NOTE

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.4 or later, then the HSM Gateway version must also be 5.4 or later. Similarly, if the HSM Gateway version is 5.4 or later, then your Fortanix DSM version must be 5.4 or later.

1. New Features

• Added support for Oracle Cloud Infrastructure (OCI) Vault External Key Management (EKM), enabling OCI Vault to perform encryption and decryption operations using keys securely managed and protected in Fortanix DSM (JIRA: EXTREQ-1117).

  For more information, refer to Fortanix Data Security Manager with OCI EKM Vault.

• Added configurable audit logging and usage tracking for transient key operations. When enabled using the subscription-level toggle in Fortanix DSM System Administration → Accounts → Account Details (on-prem clusters), transient key operations are recorded in Audit Logs and reflected in the Total operations metrics on the DSM Dashboard and Account details page (JIRA: EXTREQ-1517).

  

  

  For more information, refer to Fortanix Data Security Manager SysAdmin Guide – Transient Audit Logging.

2. Improvements

• Added support for multiple Root and Intermediate CAs in Trusted CA application authentication in Fortanix DSM, with full certificate chain validation, enabling compatibility with enterprise PKI environments (JIRA: EXTREQ-1564).

  For more information, refer to Fortanix Data Security Manager Authentication.

• Added support for multiple Subject Alternative Name (SAN) values in Trusted CA application authentication in Fortanix DSM. Client certificate authentication succeeds when the presented certificate contains any one of the configured SAN values (JIRA: EXTREQ-1563).

  For more information, refer to Fortanix Data Security Manager Authentication.

• Added support for configuring a Quantum Random Number Generator (QRNG) external entropy source (such as Quantum Entropy-as-a-Service (QEaaS)) to seed the Deterministic Random Bit Generator (DRBG) in Fortanix DSM on-premises clusters. The DSM Dashboard now displays the count of configured External Entropy connections (JIRA: PM-602).

  

  For more information, refer to the following articles:

  • Fortanix Data Security Manager SysAdmin Guide – External Entropy

  • Fortanix Data Security Manager Usage Metrics

• Improved the “Test Connection” dialog box user interface (UI) for LDAP and External Directory configurations in Fortanix DSM by optimizing button spacing and layout for a more consistent user experience (JIRA: PM-566).

  

• Updated the AWS Region field when configuring an AWS Key Management Service (KMS) Cloud Data Control (CDC) group. The Region field has been changed from a predefined drop down list to a free-text input field in both the Groups and Integrations workflows. You can now enter any valid AWS region code (for example, us-east-1) supported by AWS (JIRA: EXTREQ-1582).

  
  

  For more information, refer to the following articles:

  • Fortanix DSM - AWS Key Management Service CDC Group Setup

  • Fortanix DSM - AWS Key Management Service CDC Group Setup - Using Easy Wizard

3. Other Improvements

• Added support for ML-DSA signing and verification of pre-processed messages, including the HashML-DSA (pre-hash) variant, in accordance with FIPS 204 (JIRA: PM-566).

• Improved high-availability failover behavior in Fortanix DSM clusters by enhancing keepalived health checks to ensure faster and more reliable reassignment of the cluster virtual IP during node isolation or network failures (JIRA: ES-523).

• Improved asymmetric key import behavior for DSM-backed groups by recording the public key (pub_key) in the resulting virtual security object, aligning imported key behavior with generated keys (JIRA: ES-596).

4. API Updates

• Added support for pre-hash ML-DSA to the /crypto/v1/sign and /crypto/v1/verify REST APIs. This uses the existing hash_alg (SHA256 and SHA512) and hash fields to create and verify pre-hash ML-DSA signatures, with digest length validation enforced (JIRA: PM-566).

• Added support for transient key audit logging on Fortanix DSM on-premises subscriptions by updating SubscriptionType::OnPrem to accept optional configuration (count_transient_ops) (JIRA: EXTREQ-1517).

  This enhancement affects the following APIs:

  • POST /sys/v1/accounts, POST /sys/v1/accounts/child: Create account

  • PATCH /sys/v1/accounts/{acct_id}: Update account

• Added support for multiple Subject Alternative Names (SANs) in Trusted CA app authentication by extending TrustAnchorSubject with a new subjects array field, allowing authentication to succeed if the client certificate subject field or any of its SANs matches any configured subject, while preserving backward compatibility with existing single-subject configurations (JIRA: EXTREQ-1563).

  This enhancement affects the following APIs:

  • POST /sys/v1/apps: Create App

  • PATCH /sys/v1/apps/{app_id}: Update App

  • GET /sys/v1/apps/{app_id}/credential: Get App Credential

  • GET /sys/v1/apps/{app_id}: Get App

• Added support for configuring root and intermediate CA certificates in Trusted CA app authentication by introducing ca_certificates under a new TrustAnchor type, enabling validation of the presented certificate chain against any configured CA certificate, while maintaining backward compatibility with the existing single ca_certificate field (JIRA: EXTREQ-1564).

  This enhancement affects the following APIs:

  • POST /sys/v1/apps: Create App

  • PATCH /sys/v1/apps/{app_id}: Update App

  • GET /sys/v1/apps/{app_id}/credential: Get App Credential

  • GET /sys/v1/apps/{app_id}: Get App

5. Client New Features and Improvements

• Added the following in the PKCS#11 library (JIRA: EXTREQ-1222):

  • Added support for the CKA_PUBLIC_KEY_INFO attribute in the PKCS#11 library to retrieve the associated public key of the asymmetric keys using C_GetAttributeValue.

  • Updated CKA_SIGN and CKA_VERIFY attribute handling for symmetric keys based on MACGENERATE and MACVERIFY permissions.

• Added support for creating RSA_3072, RSA_4096, and RSA_8192 keys in the EKM provider (JIRA: EXTREQ-1191).

6. Quality Enhancements

• Upgraded Kubernetes to version 1.34.3 (JIRA: PROD-11097).  

  For more information, refer to Fortanix Data Security Manager (Release 5.6) Kubernetes Version Upgrade to 1.34 K8s.

• Upgraded Kernel to Linux version 6.8.0-94-1.0 (JIRA: PROD-11096).

• For latest versions of Fortanix DSM 3rd-party software, click here.

7. Bug Fixes

• Fixed an issue where the loading indicator continued to display indefinitely on the Fortanix DSM System Administration → Users and System Administration → Accounts pages, even after the data had successfully loaded and rendered (JIRA: ES-600). 

• Fixed an issue where modifying a user’s role from Group Auditor to Group Administrator could inadvertently remove the user from the group without generating a corresponding administrative audit event (JIRA: ES-592). 

8. Known Issues

• When using an external load balancer configured with HTTP-based health checks on port 4445 (for example, GET /sys/v1/health or /health), the endpoint returns an HTTP 404 (Not Found) response starting from DSM version 5.2 (JIRA: RODE-383).

• A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).
  Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname (JIRA: PROD-9542).

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results (JIRA: RODE-97).

• Deleting replica keys in groups with Key undo policies is reversible using the undo operation (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
  Workaround: Set the retention period to 2 days or longer under Settings→ LOG MANAGEMENT  → Retention periodfor Audit Logs to ensure recent audit log entries are visible.

• Unable to perform Kubernetes CA rotation successfully (JIRA: RODE-62).
  Workaround: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.

• When Fortanix DSM contains a large number of objects (for example, ~1000 groups, plugins, apps, and users, and ~11,000 security objects), certain UI pages may load slower than usual (JIRA: PROD-11135).
  Workaround: There is currently no direct workaround. As a mitigation, it is recommended to reduce the number of objects displayed using filters or pagination and use APIs for bulk operations instead of UI navigation in large-scale environments.

• On VMware nodes, /etc/resolv.conf may be cleared after a reboot, resulting in missing nameserver entries. Although the /etc/network/interfaces configuration is correct, any manual updates to /etc/resolv.conf are overwritten after a reboot or when the CoreDNS pod restarts (JIRA: RODE-373).

  Workaround:

  Perform the following steps:

  1. Run sudo apt purge netplan.io.

  2. If the file is removed or CoreDNS continues to have issues, manually update the nameserver entries in /etc/resolv.conf.

  3. Restart networking: sudo systemctl restart networking.

  4. Delete the CoreDNS pods to allow them to restart.

• When upgrading to Fortanix DSM version 5.7, the sdkms pod becomes stuck in the ContainerCreating state (JIRA: ES-637). 
  Workaround: Edit the sdkms deployment and remove the following to continue the upgrade:

  - mountPath: /root/enclave-runner
     name: enclave-runner

  and

  - hostPath:
      path: /var/opt/fortanix/swdist/data/v3522/config/chart/charts/infra/enclave-runner
      type: File
     name: enclave-runner

9. Fortanix Data Security Manager Performance Statistics

NOTE

• Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations. Fortanix is actively investigating this issue and evaluating potential mitigations. At this time, performance benchmark results against Fortanix 4.x releases should not be directly compared to results against 5.x releases.

• Performance testing of DSM 5.6 indicates that enabling Audit Logging introduces additional overhead for transient key cryptographic operations (encrypt/decrypt and sign/verify).

9.1 Series 3

NOTE

The numbers provided for Series 3 - Khyber ML-KEM, LMS, and BIP32 are for 1-node S3 clusters; for multiple nodes, these numbers can be multiplied by the number of nodes added.

9.2 Series 3 JCE

9.3 Series 2

9.4 Azure Standard_DC8s_v3

9.5 Series 2 JCE

9.6 Azure Standard DC8 JCE

9.7 Series 3 and Series 2 Performance Comparison

This table presents a performance comparison between Fortanix DSM Series 2 and Series 3 deployments on a 1-node cluster. 

The results demonstrate that Series 3 consistently delivers significantly higher throughput across all operations, making it a superior choice for high-performance and scalable deployments.

10. Fortanix Data Security Manager Accelerator Performance Statistics

10.1 Runtime Environment

NOTE

The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

10.2 DSM Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

10.3 Additional Modes