[5.4] - October 31, 2025

Fortanix Data Security Manager (DSM) 5.4 comes with new features, general improvements, and resolved issues. 

This release is superseded by the December 12, 2025, release.

WARNING

• If you want to upgrade Fortanix DSM to version 5.4, your current DSM version must be at least 5.2 Patch 1.

• Downgrade from 5.4 to any prior version is not supported due to Kernel upgrades.

NOTE

• Your content goes hereThe Fortanix DSM cluster upgrade must be done with Fortanix Support on call. Please reach out to Fortanix Support if you are planning an upgrade.

• The customer's BIOS version must be checked by Fortanix Support before the Fortanix DSM software upgrade. If required, the BIOS version should be upgraded to the latest version and verified by Fortanix Support for a smooth upgrade.

• If your Fortanix DSM version is 5.2 or later, then the HSM Gateway version must also be 5.2 or later. Similarly, if the HSM Gateway version is 5.2 or later, then your Fortanix DSM version must be 5.2 or later.

1. New Features

• Fortanix DSM now allows Account Administrators to configure System for Cross-domain Identity Management (SCIM) integration with Microsoft Entra ID as identity provider (IdP), enabling automated lifecycle management of users, including provisioning and de-provisioning (JIRA: EXTREQ-1015).

  

  For more information, refer to SCIM-Based User Synchronization with Fortanix DSM.

• Added support for Microsoft Entra ID Single Sign-On (SSO) integration using Security Assertion Markup Language (SAML) for authenticating to Fortanix DSM (JIRA: PROD-10797). 

  

  For more information, refer to Using Fortanix DSM with Microsoft Entra ID.

• Added support for secure manufacturing and boot flow for Fortanix FX3400 appliances to enable key provenance attestation for Fortanix DSM on-premises deployments (JIRA: PM-215). 
  For more information, refer to the Fortanix DSM Installation Guide - On-prem.

• Oracle Cloud Infrastructure (OCI) Vault keys can now be managed through Fortanix DSM using externally backed groups (JIRA: PM-256). The following operations can be performed: 

  • Create OCI externally backed groups with an API key pair.

  • Import and copy keys (Bring Your Own Key) into OCI Vault.

  • Enable or disable keys in OCI Vault.

  • Update OCI keys’ freeform_ tags (as DSM custom_metadata)

  • Rotate keys in OCI Vault.

  • Rotate a key in OCI Vault to the value of an existing Fortanix DSM key.

  • Schedule or cancel OCI Vault key versions for deletion  

  For more information, refer to the Fortanix DSM with Oracle Cloud Infrastructure Guides.

• Added support to configure a Key undo policy for a FIPS-backed Fortanix DSM group (JIRA: EXTREQ-1428).

  

  

2. Improvements

• The Fortanix DSM UI for Custom Account Roles now displays the Custom Role ID, allowing administrators to easily view and copy the ID for use in configurations or integrations (JIRA: PM-606).

  

• Updated the following in the Fortanix DSM account and group-level Client Configuration → KMIP tab (JIRA: PM-537):

  • Updated the label “Default to creating keys with Export permission” to “Implicit Export permission in KMIP operations”.

  • The “Implicit Export permission in KMIP operations” flag is now enabled by default.

  

  

  For more information, refer to the following guides:

  • User's Guide: Account Client Configurations

  • User's Guide: Group Client Configurations

  • What KMIP coverage do we provide

• Added a copy button next to the security object name in the detailed view of a security object (JIRA: ROFR-5695). 

  

3. Other Improvements

• Disallow transforming a non-exportable BIP32 key into an exportable key. Transformed objects now inherit the export restrictions of their parent, ensuring the original export restrictions are preserved (JIRA: PROD-10562).

4. API Updates

• Added the following SCIM v2.0 endpoints to support this integration (JIRA: PM-490):

  • POST /Users: Create a user in Fortanix DSM using SCIM.

  • GET /Users/{user_id}: Retrieve the user’s details using the user ID that was generated in Fortanix DSM.

  • GET /Users: Retrieve a list of users provisioned in Fortanix DSM.

  • PATCH /Users/{user_id}: Update a user's attributes.

  • DELETE /Users/{user_id}: Delete a user using the user ID that was generated in Fortanix DSM.

    NOTE

    The local-parts for these API endpoints are case-sensitive.

• The following API changes support OCI Vault integration for Bring Your Own Key (BYOK) through Externally Backed Groups  (JIRA: PM-256).

  • Integration Credential APIs:

    • Introduced a new IntegrationCredential object to manage external credential configurations. For now, only OCI credentials are supported.

      • POST /sys/v1/credentials: Create a new credential.

      • GET /sys/v1/credentials: List all credentials.

      • GET /sys/v1/credentials/{cred_id}: Retrieve credential details.

      • PATCH /sys/v1/credentials/{cred_id}: Update a credential.

      • DELETE /sys/v1/credentials/{cred_id}: Delete a credential.

      • POST /sys/v1/credentials/{cred_id}/rotate: Rotate the credential.

      • NOTE

  • Key Collections Listing API:

    • POST /sys/v1/groups/hmg/scan_collections: A new API for listing external KMS vaults, key rings, and so on. The current release supports listing OCI Vaults only.

      • This API requires the new ASSIGN_CREDENTIALS permission in addition to the normal permissions (For example, CREATE_EXTERNAL_GROUPS) required to create an externally backed group.

  • Security Object Update:

    • Added a new Boolean field allow_credential_use to specify whether a Security Object can be associated with a credential object.

• Updated the PATCH /crypto/v1/keys/{key_id} API to support unlinking parent-subkey relationships in KeyLinks of an Sobject (JIRA: PM-576).

5. Integration and Use Cases

• Added support to integrate Fortanix DSM with the External Secrets Operator (ESO) to securely fetch and manage secrets such as API keys, passwords, and certificates from Fortanix DSM and make them available to Kubernetes workloads (JIRA: EXTREQ-483).

  For more details, refer to Using Data Security Manager with External Secret Operator.

6. Client New Features and Improvements

• The TemplateAttribute field in the ReKey request is now optional in the Fortanix DSM KMIP client (JIRA: PM-616).

• Added support for a custom Certificate Authority (CA) certificate for server authentication in the Sequoia-PGP client (JIRA: PM-619).
  For more information, refer to Clients: Sequoia-PGP.

• Added support for PGP key rotation in the Sequoia-PGP client (JIRA: PM-367).
  For more information, refer to Clients: Sequoia-PGP.

7. DSM Accelerator New Features and Bug Fixes

• DSM Accelerator Webservice:

  • Added support for combined authentication for inbound application (app) connections in Fortanix DSM Accelerator Webservice, requiring both a TLS client certificate and an in-band credential in REST API requests (JIRA: PM-556). 
    For more information, refer to the DSM Accelerator Webservice Developer Guide.

  • Fortanix DSM Accelerator Webservice now supports batch APIs (crypto/v1/keys/batch) to perform encryption and decryption operations using key names (JIRA: PM-487). 
    For more information, refer to the DSM Accelerator Webservice Developer Guide.

  • Fixed the issue where the Mutual Transport Layer Security (mTLS) client in Fortanix DSM Accelerator Webservice ignored the custom CA file specified using the --ca-file <CA-FILE> command-line option or the CA_FILE environment variable during certificate verification (JIRA: ES-559).

8. Quality Enhancements

• Upgraded Kernel to Linux version 6.8.0.86.87 (JIRA: RODE-304).

• Upgraded fluentd to version 1.19 (JIRA: RODE-321).

• Upgraded Sensu to version 6.13.0-7379 (JIRA: RODE-75).

9. Bug Fixes

• Fixed an issue where deriving SLIP10 keys failed if a Cryptographic policy was set at the Fortanix DSM account or group level (JIRA: PROD-10767).

• Fixed an issue where copying SLIP10 keys was not supported (JIRA: PROD-10767).

• Fixed an issue where Fortanix DSM signing requests in the Quorum approval user interface (UI) did not display the description provided by the request creator to approvers (JIRA: ROFR-5636).

• Fixed an issue where, after upgrading Fortanix DSM to version 5.0, Network Time Protocol (NTP) checks in Sensu failed even if NTP is correctly synchronized across the cluster (JIRA: RODE-168).

• Fixed an issue where upgrading from Fortanix DSM 5.0 and later could cause package upload failures from the DSM UI, resulting in HTTP 400 or HTTP 500 errors (JIRA: ES-599).

10. Known Issues

• A Fortanix DSM account, whether normal or system administrator, with the "No Roles Can Login with Password" role selected, may experience issues when attempting to log in using a password. If the users select such an account and enter the SSO credentials, they will be logged out instead of accessing the account (JIRA: ROFR-4998).
  Workaround: The users should log in directly with SSO after the "No Roles Can Login with Password" role is set to access the account.

• The COPY KEY dialog box does not filter the HSM/External KMS groups as expected when Import key to HSM/External KMS check box is selected, if there are more than 1,000 groups in the account (JIRA: ROFR-5167)

• Unable to delete a user who was invited to an account with a "Custom account role" that includes an "All Groups Role" along with group membership assigned explicitly in the invite user workflow if the invited user has not accepted the invitation (JIRA: PROD-9409).
  Workaround: To delete the invited user, contact Fortanix Support or perform the following steps:

  • If you have already assigned explicit group memberships, perform the following steps to remove them and delete the user:

    • Change the user's account role to "Account Member".

    • Remove the group memberships one by one using the user interface.

    • Delete the user.

• The sudo get_csrs --rotate command does not support changing the hostname of the service URL. For example, if your service main URL is dsm.fortanix.net, you cannot change this main URL hostname (JIRA: PROD-9542).

• When you run sudo get_csrs --rotate command to create a new certificate pair for cluster and UI, it does not remove the old certificate pair from the sdkms pod, resulting in two certificate pairs which can lead to unexpected results (JIRA: RODE-97).

• Deleting replica keys in groups with Key undo policies is reversible using the undo operation (JIRA: PROD-9925).
  Workaround: Users should avoid deleting keys that are associated with a key-undo policy.

• The Audit Log page in Fortanix DSM does not display recent “Select Account” events when the log retention period is set to 1 day (JIRA: PROD-10441).
  Workaround: Set the retention period to 2 days or longer under Settings→ LOG MANAGEMENT  → Retention periodfor Audit Logs to ensure recent audit log entries are visible.

• Unable to perform Kubernetes CA rotation successfully (JIRA: RODE-62).
  Workaround: To perform CA rotation in DSM 5.2 and higher, contact the Fortanix Support team.

• After upgrading Fortanix DSM to version 5.0 or later, Network Time Protocol (NTP) checks in Sensu may fail even if NTP is correctly synchronized across the cluster (JIRA: RODE-168).

  NOTE

  Use the following command to override the alert:

  check-ntp.rb -u ok -w ${WARN_LEVEL} -c ${CRITICAL_LEVEL}" \

• When installing Fortanix DSM 5.2 or Fortanix DSM 5.4 software on VM-based Marketplace images (AWS, Azure, or VMware) in an air-gapped environment, the installation may fail. This issue occurs because the system contains a reference to the upstream Ubuntu repository file (JIRA: RODE-337).
  Workaround:

  • Fresh installation:

    1. Before creating a cluster:

       1. Move the upstream Ubuntu repository file: mv /etc/apt/sources.list.d/ubuntu.sources /tmp/.

       2. Run the package update command: apt-get update.

       3. Verify that no upstream Ubuntu repository references appear in the output.

    2. Proceed with cluster creation: sdkms-cluster create.

  • Upgrade from DSM 5.2 or 5.4:

    1. Before clicking Submit to start the upgrade:

       1. Move the upstream Ubuntu repository file: mv /etc/apt/sources.list.d/ubuntu.sources /tmp/.

       2. Run the package update command: apt-get update.

       3. Verify that no upstream Ubuntu repository references appear in the output.

    2. Click Submit to start the DSM upgrade.

• When upgrading to Fortanix DSM version 5.7, the sdkms pod becomes stuck in the ContainerCreating state (JIRA: ES-637). 
  Workaround: Edit the sdkms deployment and remove the following to continue the upgrade:

  - mountPath: /root/enclave-runner
     name: enclave-runner

  and

  - hostPath:
      path: /var/opt/fortanix/swdist/data/v3522/config/chart/charts/infra/enclave-runner
      type: File
     name: enclave-runner

11. Fortanix Data Security Manager Performance Statistics

NOTE

Performance testing indicates that the updated kernel introduces performance degradation in AES-related cryptographic operations.

11.1 Series 2

11.2 Azure Standard_DC8s_v3

11.3 Series 2 JCE

11.4 Azure Standard DC8 JCE

12. Fortanix Data Security Manager Accelerator Performance Statistics

12.1 Runtime Environment

NOTE

The following table lists the standard recommended runtime environment. You can choose a higher configuration for better performance.

DSM Accelerator was run in the runtime environment listed below for performance testing.

12.2 DSM Accelerator Webservice

NOTE

The performance numbers below are captured with a single node; if you need higher performance or throughput, then Fortanix recommends adding multiple nodes.

12.3 Additional Modes