[5.0] - May 27, 2025

Fortanix Data Security Manager (DSM) 5.0 comes with some exciting new features, general improvements, and resolved issues.

This release is superseded by the June 24, 2025, release.

WARNING

• You are REQUIRED to upgrade Fortanix DSM to version 4.36 Patch 1 before upgrading to version 5.0. If you want to upgrade Fortanix DSM to version 5.0 from a version earlier than 4.36 Patch 1, please contact the Fortanix Support team at your earliest to validate the upgrade path.

• Downgrade from 5.0 to any prior version is not supported due to an upgrade of the appliance operating system.

NOTE

• If you are using a custom sudo user, ensure that the default administrator user is enabled with root privileges before upgrading to Fortanix DSM version 5.0. The administrator user must be able to log in with a password and be part of the sudo group.

• During the upgrade, the /etc/sudoers file is overwritten, which can result in the loss of sudo access for the custom sudo user.

• The Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 4.31 or later, then the HSM Gateway version must also be 4.31 or later. Similarly, if the HSM Gateway version is 4.31 or later, then your Fortanix DSM version must be 4.31 or later.

1. New Features

• Fortanix DSM now introduces a global dark mode user interface (UI) theme as part of the visual alignment with the Fortanix Armor platform (JIRA: PM-465).
  

2. Improvements

• Users can now log in using any case variation of their email address when logging in to Fortanix DSM using Single Sign-On (SSO) (JIRA: PM-498).

3. Other Improvements

• The Fortanix DSM restore scripts are now enhanced to support Secure File Transfer Protocol (SFTP)-based backup repositories for improved compatibility with storage solutions (JIRA: PM-430).

• Improved the performance of the GetAllUsers API to reduce the latency for accounts with a large number of groups (JIRA: PROD-9500).

• Improved the query of keys in KMIP Locate(JIRA: PROD-10177).

• Added checks for the Extended Key Usage extension in Key Attestation Authority sharing APIs (JIRA: PROD-9941).

4. API Updates

• This release does not have any API changes.

5. Integrations and Use Cases

• Added support for Fortanix DSM integration with Quadient Inspire Designer. For more details, refer to the Fortanix DSM with Quadient Inspire Designer Integration Guide.

6. Client Improvements

• Added client-side failover support to the Fortanix DSM Java Cryptography Extension (JCE) Provider to retry requests on alternate endpoints upon request timeout (JIRA: PM-204).
  For more details, refer to the Clients: Java Cryptography Extension (JCE) Provider.

7. DSM Accelerator New Features and Bug Fixes

• DSM Accelerator Webservice:

  • Fixed an issue causing latency deviation in the first request to the Fortanix DSM Accelerator Webservice after an /auth request (JIRA: PROD-10270).

8. Quality Enhancements

• Fortanix DSM and DSM clients now run on and support Ubuntu 24.04 LTS, as Ubuntu 20.04 LTS is approaching end-of-life (JIRA: PM-501).

• Upgraded the FX2200 Series 2 BIOS version to F16 and CPU microcode to 0xFA(JIRA: DEVOPS-5600).

• Upgraded Sensu to version 6.12.0-7321 (JIRA: PROD-9944).

9. Security Improvements

• Updated Intel SGX attestation verification logic to correctly interpret potential future attestation evidence and endorsements from Intel. As of the publication date of these release notes, Intel has not published any evidence or endorsements that would cause security issues with the previous logic (JIRA: RTE-308, RTE-450, RTE-447).

10. Bug Fixes

• Fixed an issue where if an app belongs to more than 1000 groups, adding a new group to the app fails (JIRA: ES-499).

• Fixed an issue where the create operation for security object creation did not work for the Azure Managed HSM plugin (JIRA: PROD-7078).

• Fixed Fortanix DSM UI performance issues when loading groups and apps if an account has more than 1000 groups and apps (JIRA: ES-500).

11. Known Issues

• Upgrading from Fortanix DSM 5.0 and later could cause package upload failures from the DSM UI, resulting in HTTP 400 or HTTP 500 errors (JIRA: ES-599).

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167).

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname (JIRA: PROD-9542).

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod resulting in two certificate pairs which can lead to unexpected results (JIRA: PROD-9570).

• Deleting replica keys in groups with key history policies only results in a soft-delete of the keys (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• When creating a group-level Quorum approval policy, users with the “Custom account roles permissions” are not listed in the user list (JIRA: ROFR-5253).
  Workaround: Assign the Get External Roles permission to allow the users to be listed in the quorum policy.

• Unable to save Account Cryptographic policy with the below permissions (JIRA: ROFR-5254).

  "Create Account Security Object Policies",
  "Set Approval Request Expiry",
  "Get All Users"

  Workaround: Add the Update Account Security Object Policies permission to the Custom account role to enable saving the Account Cryptographic policy.

• After upgrading Fortanix DSM to version 5.0 or later, Network Time Protocol (NTP) checks in Sensu may fail even if NTP is correctly synchronized across the cluster (JIRA: RODE-168).

  NOTE

  Use the following command to override the alert:

  check-ntp.rb -u ok -w ${WARN_LEVEL} -c ${CRITICAL_LEVEL}" \

12. Fortanix Data Security Manager Performance Statistics

NOTE

As part of this major release, the underlying operating system of Fortanix DSM has been upgraded from Ubuntu 20.04 to Ubuntu 24.04, which includes a significant Linux kernel update from version 5.4.0 to 6.8.0, along with multiple software package updates.

Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations.

The Fortanix engineering team is actively investigating this issue and evaluating potential mitigations.

12.1 Series 2

12.2 Azure Standard_DC8_v2

12.3 Series 2 JCE

12.4 Azure Standard DC8 JCE

13. Fortanix Data Security Manager Accelerator Performance Statistics

13.1 Runtime Environment

NOTE

The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

13.2 DSM Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

13.3 Additional Modes