[5.9] DSM - August 7, 2026

Fortanix Data Security Manager (DSM) 5.9 comes with some exciting new features, enhancements, general improvements, and resolved issues.

WARNING

• If you want to upgrade Fortanix DSM to version 5.9, your current DSM version must be at 5.8* or 5.7*.

• Downgrade from 5.9 to any prior version is not supported due to Kernel upgrades.

*The minimum required version is specific to your current major.minor version. You must first upgrade to the required patch level within your current version before proceeding to version 5.9.

NOTE

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.8 or later, then the HSM Gateway version must also be 5.8 or later. Similarly, if the HSM Gateway version is 5.8 or later, then your Fortanix DSM version must be 5.8 or later.

1. New Features

• Added support for rotating Amazon Web Service (AWS) External Key Store (XKS) Root Keys manually or using the Key rotation policy feature in Fortanix DSM. This enables AWS KMS External Key Stores to reference XKS Root Keys by their security object names instead of UUIDs, allowing seamless root key rotation (JIRA: PM-386).

  

  For more information, refer to Fortanix DSM with AWS External Key Store (XKS).

• Added UI support for Azure Monitor Log Ingestion API logging configurations, enabling DSM audit logs to be ingested into Azure Monitor using the Log Ingestion API as an alternative to the legacy Azure Log Analytics Data Collector API. Users can configure the new integration under Account Settings → Log Management → Custom Log Management Integrations (JIRA: PM-664).

  For more information, refer to Logging.

  NOTE

  The Azure Monitor Log Ingestion API integration is not supported for System Administration → Settings → LOG MANAGEMENT (Sysadmin account). For Sysadmin account logging, continue using the legacy Azure Log Analytics Data Collector API integration. This limitation applies only to the Sysadmin account; all regular DSM accounts can use the Azure Monitor Log Ingestion API integration.

2. Enhancements

• Added COPY OCI VAULT EKM KEY ID and COPY OCI VAULT EKM KEY VERSION ID options to the security object COPY ID drop down menu. These options copy the security object “Name” as the OCI Vault EKM Key ID and the security object “UUID” as the OCI Vault EKM Key Version ID (JIRA: PM-701).
  
  

  For more information, refer to Oracle Cloud Infrastructure KMS Bring Your Own Key.

• Added support for OCI Dedicated Region (previously known as Oracle Dedicated Region Cloud@Customer (DRCC)) deployments in Oracle Bring Your Own Key (BYOK). Improved OCI region validation to support additional OCI realm formats, including Sovereign Cloud and Dedicated Regions, enabling key management operations in supported Oracle cloud environments (JIRA: EXTREQ-1722).
  
  

  For more information, refer to Oracle Cloud Infrastructure KMS Group Setup.

• Improved the Quorum approval request task descriptions for Secure Node Join requests by displaying more descriptive task summary, including the target node identity and requested trust status update (JIRA: ROFR-5991).

  

3. Other Improvements

• Enhanced the performance of DSM cryptographic operations by incorporating cryptographic library performance optimizations (JIRA: PROD-11541).

• Improved the POST /crypto/v1/keys/:key_id/activate API to support Group Quorum approval policies. Key activation requests now follow the configured approval workflow before transitioning a key from the PreActive state to the Active state (JIRA: EXTREQ-1028).

• Added additional authentication failure logging for Key Management Interoperability Protocol (KMIP) connections to the DSM system log, improving server-side troubleshooting of client authentication failures (JIRA: PM-697).

4. Quality Enhancements

• Updated the BIOS for the Fortanix FX3400 appliances to include the latest Intel microcode and associated firmware updates required for IPU 2026.3 compatibility (JIRA: RODE-473).

• Updated the BIOS to version 11.13.FP01 for Fortanix FX3400 appliances, resolving an issue where installed memory Dual In-line Memory Module (DIMMs) could be incorrectly detected (JIRA: RODE-474).

• The third-party software upgrade list can be found here.

5. Bug Fixes

• Fixed an issue where the Activate operation in DSM did not honor the configured Group Quorum approval policy (JIRA: EXTREQ-1028).

  NOTE

  Existing integrations or plugins that invoke the Activate API may need to be updated to handle quorum approval, or administrators can remove Activate from the Group Quorum approval policy if quorum approval is not desired for that operation.

• Fixed an issue that prevented certain Nutanix clusters from integrating with DSM 5.7 through KMIP when the Nutanix KMS client included key operations in its requests that are not supported by DSM (JIRA: ES-647).

• Fixed an issue where the sdkms pod could become stuck in the ContainerCreating state during an upgrade to Fortanix DSM 5.7 (JIRA: ES-637).

• Fixed an issue where DSM returned an incorrect HTTP error response for cryptographic operations on disabled security objects when using the OCI Vault EKM integration (JIRA: PROD-11536).

• Fixed a UI rendering issue that caused a blank screen when rotating keys in a group with more than 1,000 keys (JIRA: ROFR-6013).

• Fixed an issue in DSM FIPS deployments where high concurrent request volumes could cause intermittent health check failures, resulting in false monitoring alerts and temporary service unavailability (JIRA: ES-645).

• Fixed an issue where the System Administration quorum approval policy summary could incorrectly display Secure Node Join as a selected operation when Secure Node Join was not enabled (JIRA: ROFR-5978).

• Fixed an intermittent issue where PGP key rotation could fail in on-premises DSM deployments with a "Sobject already linked" error under low-latency conditions (JIRA: ES-594).

• Fixed an issue where the Audit Log page in Fortanix DSM did not display any log events when the log retention period is set to 1 day (JIRA:PROD-10441).

6. Security Fixes

• Improved email address and domain verification for user sign-up, invitations, and email address updates (JIRA: PROD-11325).

• Updated Linux kernel from 6.8.0-124 to 6.8.0-136 to improve system stability and ensure alignment with the latest upstream kernel fixes (JIRA: RODE-583).

• Improved the security of LDAP integrations by using Integration Credentials to securely manage LDAP service account credentials. The LDAP integration configuration under Account Settings → AUTHENTICATION → SINGLE SIGN-ON → ADD LDAP INTEGRATION now includes a Fortanix DSM Group field in the Add service account section for configuring Integration Credentials (JIRA: PROD-11428 & ROFR-5990).

  

7. Known Issues

• If a Fortanix DSM software download initiated through a URL (UI or API) is interrupted (for example, due to a page refresh or network issue), retrying the download may fail with:
  Another download is still in progress (HTTP 409).
  The previous attempt may continue to be treated as active, and the state is not cleared automatically (JIRA: PROD-11136).
  Workaround:
  Use alternative methods such as uploading the build from a local file through the DSM UI, using CLI upload, or downloading the build directly on the cluster node (for example, with wget).

• On VMware nodes, /etc/resolv.conf may be cleared after a reboot, resulting in missing nameserver entries. Although the /etc/network/interfaces configuration is correct, any manual updates to /etc/resolv.conf are overwritten after a reboot or when the CoreDNS pod restarts (JIRA: RODE-373).

  Workaround:

  Perform the following steps:

  1. Run sudo apt purge netplan.io.

  2. If the file is removed or CoreDNS continues to have issues, manually update the nameserver entries in /etc/resolv.conf.

  3. Restart networking: sudo systemctl restart networking.

  4. Delete the CoreDNS pods to allow them to restart.

• When users edit a quorum approval policy configured with multiple reviewers, DSM may display the Using second factor security key is required to approve requests check box as unchecked in the Quorum approval policy screen, even though multi-factor authentication (MFA) enforcement continues to work as expected (JIRA: PROD-11444).

• A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).
  Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate workflow does not support changing existing DNS hostnames configured in the service URL or Subject Alternative Name (SAN) entries (JIRA: PROD-9542).

  This issue occurs when:

  • get_csrs --rotate is used to generate CSRs, and

  • install_certs --rotate is used to install certificates where existing DNS/SAN hostnames (single or multiple) are modified or replaced.

  For example, if the existing service URL hostname is dsm.fortanix.net, changing it to a different hostname while using certificate rotation is not supported.

  Workaround:

  • Do not use the --rotate option when changing existing DNS/SAN hostnames.

  • If certificate rotation is required with SAN certificates, retain the existing DNS entries and append additional DNS entries instead of replacing or modifying the current ones.

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results (JIRA: RODE-97).

• Deleting replica keys in groups with Key undo policies is reversible using the undo operation (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• Unable to perform Kubernetes CA rotation successfully (JIRA: RODE-62).
  Workaround: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.

• When Fortanix DSM contains a large number of objects (for example, ~1000 groups, plugins, apps, and users, and ~11,000 security objects), certain UI pages may load slower than usual (JIRA: PROD-11135).
  Workaround: There is currently no direct workaround. As a mitigation, it is recommended to reduce the number of objects displayed using filters or pagination and use APIs for bulk operations instead of UI navigation in large-scale environments.

8. Fortanix Data Security Manager Performance Statistics

NOTE

Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations. Fortanix is actively investigating this issue and evaluating potential mitigations. At this time, performance benchmark results against Fortanix 4.x releases should not be directly compared to results against 5.x releases.

8.1 Series 3

NOTE

The numbers provided for Series 3 - Khyber ML-KEM, LMS, and BIP32 are for 1-node S3 clusters; for multiple nodes, these numbers can be multiplied by the number of nodes added.

8.2 Series 3 JCE

8.3 Series 2

8.4 Azure Standard_DC8s_v3

8.5 Series 2 JCE

8.6 Azure Standard DC8 JCE

9. Installation