[5.8] DSM - June 26, 2026

Fortanix Data Security Manager (DSM) 5.8 comes with new features, general improvements, and resolved issues.

This release is superseded by the July 14, 2026, release.

WARNING

• Some of the security fixes included in prior releases may cause a degradation of the performance of RSA and EC cryptographic operations. If cryptographic operation performance is a concern, this release should be tested before deployment in production.

• If you want to upgrade Fortanix DSM to version 5.8, your current DSM version must be at least 5.4 Patch 4* or 5.6 Patch 2*.

• Downgrade from 5.8 to any prior version is not supported due to Kernel upgrades.

*The minimum required version is specific to your current major.minor version. You must first upgrade to the required patch level within your current version before proceeding to version 5.8.

NOTE

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.7 or later, then the HSM Gateway version must also be 5.7 or later. Similarly, if the HSM Gateway version is 5.7 or later, then your Fortanix DSM version must be 5.7 or later.

1. New Features

• Added support for Quorum approval policy for Secure Node Join in the System Administration account, enabling approval of new nodes joining the cluster to require approval from a configured quorum of system administrators instead of a single administrator (JIRA: EXTREQ-1336).

  

  For more information, refer to the following articles:

  • Sysadmin Settings - Quorum Policy

  • Fortanix DSM Secure Node Join

  • Fortanix DSM Installation Guide - On-Premises.  

2. Enhancements

• Added support in Fortanix DSM user interface (UI) for configuring private claim validation for JSON Web Token (JWT) application authentication, enabling administrators to create and edit Rego-based policies that evaluate private JWT claims during application authentication (JIRA: PM-684).

  

  For more information, refer to Fortanix DSM Authentication.

• Added support to the Fortanix DSM UI for generating LMS keys using the LMOTS_SHA256_N24_W4 parameter set by specifying the winternitz_width parameter during key creation (JIRA: PM-688).

  

  For more information, refer to Fortanix DSM Key Lifecycle Management.

• Added support for Azure Monitor Log Ingestion API logging configurations, enabling DSM audit logs to be ingested into Azure Monitor using the Log Ingestion API as an alternative to the legacy Azure Log Analytics Data Collector API (JIRA: EXTREQ-1652).

  NOTE

  This feature has only API support in the current release.

• Added support for preserving specific characters during Version 2 format-preserving tokenization (format_v2), while allowing other unknown characters to be selectively stripped or rejected, providing finer-grained control over token formatting (JIRA: PM-660). 

• Updated the Terms and Conditions link on the Fortanix DSM On-Prem sign-up page to reflect the latest DSM On-Prem License Agreement (JIRA: PROD-11334).

  

3. Other Improvements

• Enhanced trial account enforcement by preventing crypto applications and administrative applications in expired trial accounts from authenticating and creating new sessions after trial expiration, helping reduce resource consumption (JIRA: PROD-11151).

• Updated the sdkms-cluster remove command to require the --version parameter. This change ensures consistent node removal behavior during Fortanix DSM upgrades by using the specified DSM package version instead of automatically determining the version from the node being removed (JIRA: RODE-403).

  For more information, refer to Fortanix DSM Software Upgrade.

• Added support for Module-Lattice-Based Digital Signature Algorithm (ML-DSA) keys in the PKCS#10 Certificate Signing Request (CSR) Plugin, allowing users to generate CSRs for ML-DSA key pairs stored in Fortanix DSM (JIRA: PM-673).

• Improved performance of SHA-3 hash calculation (JIRA: PROD-9479). 

4. API Updates

• Added support for Azure Monitor Log Ingestion API logging configurations by introducing Data Collection Rule (DCR)-based integration settings and Azure credential objects, enabling DSM audit logs to be ingested into Azure Monitor using the Log Ingestion API as an alternative to the legacy Azure Log Analytics Data Collector API (JIRA: EXTREQ-1652).

  This enhancement affects the following APIs:

  • POST /sys/v1/credentials: Create Credential

  • PATCH /sys/v1/credentials/{credential_id}: Update Credential

  • PATCH /sys/v1/accounts/{account_id}: Update Account

• Added support for configuring a Quorum approval policy for Secure Node Join in the System Administration account, enabling new node additions to a cluster AllowList to require approval from a configured quorum of system administrators (JIRA: EXTREQ-1336).

  This enhancement affects the following APIs:

  • PATCH /admin/v1/cluster/node_identities/{name}: Update Node Identity

  • PATCH /admin/v1/cluster: Configure Cluster

  • POST /admin/v1/cluster/join: Join Cluster

• Added support for the passthrough_specific input processing option in Version 2 tokenization keys (format_v2), allowing specific characters to be preserved during tokenization while other unknown characters can be configured to be stripped or rejected (JIRA: PM-660).

  This enhancement affects the following APIs:

  • POST /crypto/v1/keys: Create Security Object

  • PATCH /crypto/v1/keys/{kid}: Update Security Object

• Enhanced the OpenAPI documentation to support configurable DSM endpoint URLs, allowing users to specify and test API requests against their own DSM environments directly from the API documentation “Try Me“ interface (JIRA: PROD-11483). 

5. Client New Features, Improvements, and Bug Fixes

• Added support for the ML-DSA algorithm in Fortanix CNG library (JIRA: EXTREQ-1625).

• Added Certificate Authentication support for Fortanix PKCS#11 library on Microsoft Windows (JIRA: PM-678).

  For more information, refer to the PKCS#11 Developers Guide.

• Provided a workaround for a panic or crash observed in PKCS#11 flow when using OpenSSL provider with PQC algorithms (JIRA: PM-679).

  For more information, refer to the PKCS#11 Developers Guide.

• Enhanced server certificate revocation validation failures observed on certain legacy Windows systems due to incorrect certificate chain order (JIRA: ES-633).

• Fixed PKCS#11 library hangs observed during API requests made to DSM when connectivity to DSM was interrupted, improving keepalive duration and timeout handling (JIRA: ES-687). 

6. DSM Accelerator New Features

• Added PKCS#8 AES-CBC encrypted private key support to Fortanix DSM Accelerator Webservice mTLS client configuration, enabling the use of encrypted client keys for mTLS configuration (JIRA: PM-676).

  For more information, refer to the DSM Accelerator Webservice Developer Guide. 

7. Integration and Use Cases

• Added support for Azure Managed HSM external key management, enabling Azure Managed HSM to perform cryptographic operations using keys securely managed and protected in Fortanix DSM (JIRA: PM-613). 

  For more information, refer to Fortanix DSM with Azure Key Vault Managed HSM External Key Management.

• Enhanced the Salesforce BYOK plugin to support Salesforce External Client Apps as an alternative to Connected Apps, enabling continued integration with Salesforce as the platform transitions away from username or password-based OAuth 2.0 authentication flows (JIRA: EXTREQ-1551).

  For more information, refer to Exporting Fortanix DSM Keys to Cloud Providers for BYOK - Salesforce. 

8. Quality Enhancements

• The third-party software upgrade list can be found here. 

9. Security Fixes

• Updated Linux kernel from 6.8.0-117 to 6.8.0-124 to improve system stability and ensure alignment with the latest upstream kernel fixes (JIRA: RODE-511).

10. Bug Fixes

• Fixed an issue that prevented user’s from updating custom Certificate Authority (CA) certificates for Splunk integrations in Log Management through the Fortanix DSM UI, resulting in an incorrect certificate validation error for valid PEM-formatted certificates (JIRA: ES-641).

• Fixed an issue where health check requests to the /health endpoint on port 4445 could return an HTTP 502 response from the Fortanix DSM proxy service, causing health check failures despite the service being available (JIRA: RODE-395).

• Fixed an issue where HTTP-based health checks to the /health endpoint returned an HTTP 404 response, preventing external load balancers from receiving a successful health check status (JIRA: RODE-383).

• Fixed an issue that could cause inaccurate time calculations within enclaves, affecting time-dependent operations (JIRA: ES-603).

• Fixed an issue that could cause Azure Bring Your Own Key (BYOK) key rotation operations to fail and trigger sdkms pod instability, resulting in errors when viewing key links (JIRA: ES-608).

• Fixed an issue where bearer tokens generated using a previous application API key could not be used to perform operations during the configured grace period after the API key was regenerated using the Fortanix DSM UI using the REGENERATE option in the application’s detailed view (JIRA: EXTREQ-1688).

• Fixed an issue where the Rotate to Existing Key dialog box did not return all matching keys in search results when Fortanix DSM contained a large number of keys (JIRA: ROFR-5930).

• Fixed an issue where the digest algorithm for Leighton-Micali Signature (LMS) keys appeared as empty in the Fortanix DSM UI and as null in API responses instead of SHA256 (JIRA: PROD-11444).

• Fixed an issue that could generate erroneous audit log entries reporting "App failed to authenticate, application id: Unknown" for failed KMIP authentication attempts, resulting in invalid application lookups in the Audit Logs UI (JIRA: ES-632). 

11. Known Issues

• If a Fortanix DSM software download initiated through a URL (UI or API) is interrupted (for example, due to a page refresh or network issue), retrying the download may fail with:
  Another download is still in progress (HTTP 409).
  The previous attempt may continue to be treated as active, and the state is not cleared automatically (JIRA: PROD-11136).
  Workaround:
  Use alternative methods such as uploading the build from a local file through the DSM UI, using CLI upload, or downloading the build directly on the cluster node (for example, with wget).

• On VMware nodes, /etc/resolv.conf may be cleared after a reboot, resulting in missing nameserver entries. Although the /etc/network/interfaces configuration is correct, any manual updates to /etc/resolv.conf are overwritten after a reboot or when the CoreDNS pod restarts (JIRA: RODE-373).

  Workaround:

  Perform the following steps:

  1. Run sudo apt purge netplan.io.

  2. If the file is removed or CoreDNS continues to have issues, manually update the nameserver entries in /etc/resolv.conf.

  3. Restart networking: sudo systemctl restart networking.

  4. Delete the CoreDNS pods to allow them to restart.

• When creating a System Administration Quorum approval policy in DSM on a cluster where Secure Node Join is not enabled, the policy summary dialog may incorrectly display Secure node join as selected under Operations that require Quorum approval. This is a display issue only and does not affect policy enforcement (JIRA: ROFR-5978). 

• When users edit a quorum approval policy configured with multiple reviewers, DSM may display the Using second factor security key is required to approve requests check box as unchecked in the Quorum approval policy screen, even though multi-factor authentication (MFA) enforcement continues to work as expected (JIRA: PROD-11444).

• A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998). 
  Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167)

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate workflow does not support changing existing DNS hostnames configured in the service URL or Subject Alternative Name (SAN) entries (JIRA: PROD-9542). 

  This issue occurs when:

  • get_csrs --rotate is used to generate CSRs, and

  • install_certs --rotate is used to install certificates where existing DNS/SAN hostnames (single or multiple) are modified or replaced.

  For example, if the existing service URL hostname is dsm.fortanix.net, changing it to a different hostname while using certificate rotation is not supported. 

  Workaround:

  • Do not use the --rotate option when changing existing DNS/SAN hostnames.

  • If certificate rotation is required with SAN certificates, retain the existing DNS entries and append additional DNS entries instead of replacing or modifying the current ones.

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results (JIRA: RODE-97).

• Deleting replica keys in groups with Key undo policies is reversible using the undo operation (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
  Workaround: Set the retention period to 2 days or longer under Settings→ LOG MANAGEMENT  → Retention periodfor Audit Logs to ensure recent audit log entries are visible.

• Unable to perform Kubernetes CA rotation successfully (JIRA: RODE-62).
  Workaround: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.

• When Fortanix DSM contains a large number of objects (for example, ~1000 groups, plugins, apps, and users, and ~11,000 security objects), certain UI pages may load slower than usual (JIRA: PROD-11135).
  Workaround: There is currently no direct workaround. As a mitigation, it is recommended to reduce the number of objects displayed using filters or pagination and use APIs for bulk operations instead of UI navigation in large-scale environments.

• When upgrading to Fortanix DSM version 5.7, the sdkms pod becomes stuck in the ContainerCreating state (JIRA: ES-637). 
  Workaround: Edit the sdkms deployment and remove the following to continue the upgrade:

  - mountPath: /root/enclave-runner
     name: enclave-runner

  and

  - hostPath:
      path: /var/opt/fortanix/swdist/data/v3522/config/chart/charts/infra/enclave-runner
      type: File
     name: enclave-runner

12. Fortanix Data Security Manager Performance Statistics

NOTE

Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations. Fortanix is actively investigating this issue and evaluating potential mitigations. At this time, performance benchmark results against Fortanix 4.x releases should not be directly compared to results against 5.x releases.

12.1 Series 3

NOTE

The numbers provided for Series 3 - Khyber ML-KEM, LMS, and BIP32 are for 1-node S3 clusters; for multiple nodes, these numbers can be multiplied by the number of nodes added.

12.2 Series 3 JCE

12.3 Series 2

12.4 Azure Standard_DC8s_v3

12.5 Series 2 JCE

12.6 Azure Standard DC8 JCE

13. Fortanix Data Security Manager Accelerator Performance Statistics

13.1 Runtime Environment

NOTE

The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

13.2 DSM Accelerator Webservice

NOTE The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

13.3 Additional Modes