Added

• The CipherTrust Key Broker for Google Cloud EKM service is now available. Register for the service through the Google Marketplace to gain access to an HSM secured key encryption key for use as a wrapping key in Google Cloud EKM. Access the service documentation for more information about the CipherTrust Key Broker for Google Cloud EKM service.

Bugs Found

• EKMS-652 - The Add Key Ring button is disabled in the CipherTrust Key Broker for Google Cloud EKM service if you attempt to create a Key Ring without first adding an EKM Policy. Create an EKM Policy before adding a Key Ring.
• EKMS-659 - The CipherTrust Key Broker for Google Cloud EKM dashboard URL shows a 404.  Access the CipherTrust Key Broker for Google Cloud EKM log in page and enter the FQDN of your CipherTrust Key Broker for Google Cloud EKM dashboard to log in.
• DPS-5823 - New service clients created in the North America (NA) environment cannot connect to a service on Windows Server 2012r2 operating systems.

Added

• Version 10.2 of the HSM service client is now available for download from Thales Data Protection on Demand. This client supports hybrid usage of both HSMoD services and the Luna HSM product line, as detailed in the HSM on Demand Client User Guide. Refer to the HSM Client 10.2 Customer Release Notes document for more information. See Upgrading your HSMoD Service Client for more information about updating your HSMoD service client. 
• HSM on Demand service clients now use JWT authentication. 
• The HSMoD service client is now supported on the following operating systems:
  • RHEL8/CentOS8
  • Windows Server 2019 (standard and core)
• You can configure additional logs (Application Error Logs and Curl Logs) in the application console. See the HSM on Demand Troubleshooting section for more information. 

Changed

• The new HSMoD service has updated entries in the REST and XTC sections of the crystoki.ini (Windows) and the Chrystoki.conf (Linux) configuration files. Refer to the Configuration File Summary for a description of the default options and additional settings. 
• Deleting a client from a JWT authenticated HSMoD service now revokes the client ID and client secret associated with that client. Create a new HSMoD service client for the service to resume access. See Managing HSMoD Services for more information about deleting a service client and revoking the service credentials. 

Removed

• Older Java versions are no longer supported. See the HSM Client 10.2 Customer Release Notes document for more information.
• If your application relies on Oracle Java 7 or Java 8, you must update the advanced version provided by Oracle. You require (at minimum) version 7u131 or 82u121. Please refer to the Oracle website for more information.
• If your application relies on IBM Java 7 or 8, do not update your service client.If you want to update your client software, consider adopting OpenJDK or another supported Java version See Supported Cryptographic APIs.

Bugs Found

• DPS-5531 - If you exit the Suggest An Edit feature, in the DPoD Platform documentation, using the Close button, you can no longer scroll the documentation page. Refresh the page to continue scrolling.
• DPS-5493 - The Rotation Policies section of the Salesforce Key Broker service do not display. There is no workaround at this time.
• DPS-5433 - Tenant administrator users cannot reset their password using the Actions column in the User Details table. Change your Tenant Administrator password by clicking Change password in the upper right corner of the DPoD UI. 
• SH-4987 - When creating a self-signed certificate with cmu selfsigncertificate, additional characters are added to the specified serial number. Use cmu getattribute to list the actual serial number assigned to the certificate.

Bugs Fixed

• Luna-11616 - LunaCM displays available slots if the client fails to resolve the DPoD service's hostname. Restart LunaCM to re-attempt the connection to the service.
• Luna-11447 - Resolved a segmentation fault stopping HA members from failing over to an HSMoD service.
• HOD-957 - The default log level in the client was updated to provide improved details. 

Changed

• Enforcing restriction of 100 token objects (or 50 RSA-2048 key pairs) per service. We recommend you remove any unused keys to comply with the 100 token object limit and improve HSM performance.

Added

• Tenant Administrator users can now use HSM on Demand services.

Deprecated

• Removing support for the DPoD API endpoint /services in the next release. We recommend you begin using the /service_instances endpoint for all related HSMoD service client operations. 

Bugs Found

• DPS-2808: When the Service Provider deletes a Tenant, if the deletion fails the Tenant Details page is not accessible. Workaround: This issue results from attempting to delete a Tenant with active services. To clear this state you must remove the blocking service from the Tenant's Application Owner users.
• HOD-957: There is no user feedback in the lunacm utility on connection timeout. As a result, the client can appear to hang indefinitely. Workaround: Wait for the client to timeout or close and restart lunacm to re-attempt the connection.
• KBR-620: The Salesforce Key Broker service is not available over the API. Workaround: Use a DPoD Application Owner account to configure a Salesforce Key broker service.
• DPS-2161: Services with extended ascii characters in their name do not display properly in reports. Workaround: Open the report in a spreadsheet program with UTF-8 encoding.

Bugs Fixed

• DPS-3083: The DPoD API endpoint /service_instances succeeds on the bind HSMoD service client operation.
• DPS-2614: Tenant names are now trimmed on creation.
• DPS-2494: Non-functional tenants that appear in the "Pending" state in the user interface are no longer included in reports.

Changed

• The DPoD Platform Customer Release Notes (CRN) has been removed from distribution. Please refer to the Platform Changelog to stay up-to-date on the DPoD platform and its available services.
• Please refer to the Universal Client Customer Release Notes (CRN) for more information about the Universal Client used by HSM on Demand services. 

Bugs Fixed

• SH-5169 - Resolved an issue where clients with a very high session version could fail when connecting to the service.

Added

• Achieved FIPS 140-2 Level 3 certification. See Customer Release Notes 1.11 for more information.
• NoIndex added to enterprise tenant marketplaces, eliminating enterprise tenant URLs from appearing in Search results. See Customer Release Notes 1.11 for more information.

Changed

• Updated HSMoD service client. All users are required to upgrade their client as soon as possible, as the previously available client contains certificates that expire on December 31, 2019. Certificates or key material stored on the HSMoD service will still be available following the upgrade. See Upgrading your HSMoD Service Client.
• ms2Luna does note work in FIPS mode. See Customer Release Notes 1.11 for more information.
• Updates to supported Cryptographic API's. See Luna Cloud HSM Service Supported Client Platforms for the list of supported Cryptographic API's.
• Various UI enhancements and improvements.

Deprecated

• HSMoD service client v1.1.x. This version of the client will not connect to HSMoD services beyond Dec 31, 2019.
• Utilities included in older HSMoD service clients downloaded before October 2019 can have a delay of up to 20 seconds on start up. We recommend you install the latest service client. See Upgrading your HSMoD Service Client for more information.

Features under development

• FIPS Certification Firmware Candidate - The HSM firmware is undergoing FIPS certification coordination.

Added

• Added the Virtual Token Library (VTL) to the 1.10 HSMoD service client. 
• Client patched reducing timeout and failover issues during key and certificate migration.
• Direct link to SafeNet Data Protection on Demand **Status Page** available in user interface footer.
• The Company name no longer needs to be unique. Now, multiple enterprise tenants can share a common company name.
• Service provider monthly reports now include the minimum billable units (MBU) selection from the tenants **Initial Elections** form.

Deprecated

• Deprecating support for 32-bit operating systems.
• Ending support for Windows Server 2008 and Windows Server 2008 R2.

Removed

• You cannot download a new HSMoD service client for a service which existed prior to release 1.5. Recreate the service.

Bugs Fixed

• DPS-3071 - Deleting an application owner account before deleting any associated platform credentials results in being unable to delete both the platform credentials and any associated subscriber group.
• DPS-3006 - The HSM on Demand service generic mapping refers to key_vault in reports and the API.

Features under development

• FIPS Certification Firmware Candidate - The HSM firmware is undergoing FIPS certification review.

Added

• Initial Elections Form. See Converting from Evaluation to Subscriber for more information.
• Disaster Recovery.

Changed

• FIPS Mode is more restrictive. See Customer Release Notes 1.11 for more information.
• Some criteria in platform wizards now mandatory.

Deprecated

• LunaProvider.jar

Removed

• You cannot download new HSMoD service clients for a service which existed prior to release 1.5. Recreate the service.

Features under development

• FIPS Certification Firmware Candidate - The HSM firmware is undergoing FIPS certification review.
• Conversion from evaluation to subscriber tool for enterprise tenants.

Added

• Sign up page. See Registering Tenants Automatically for more information.

Removed

• You cannot download new HSMoD service clients for a service which existed prior to release 1.5. Recreate the service.

Bugs Fixed

• DPS-2159 - When the service provider administrator edits an enterprise tenant, the tenant administrator field displays empty.

Features under development

• DPoD enterprise tenant registration page
• Pipeline improvements

Added

• Introduced a multi-factor authentication requirement using an authentication application on a mobile device for all users.
• Added the following HSM on Demand service tiles:
  • HSM on Demand for CyberArk Digital Vault
  • HSM on Demand for Java Code Signer
  • HSM on Demand for Microsoft ADCS
  • HSM on Demand for Authenticode
  • HSM on Demand for Microsoft SQL Server
• Added the Key Migration Guide to the HSM Client Guides in the Help system. This migration guide now details the process for transferring key material from an Amazon Web Services (AWS) cloud HSM to a DPoD HSM on Demand service.

Changed

• Updated the following HSM on Demand service tiles:
  • HSM on Demand
  • HSM on Demand for Digital Signing
  • HSM on Demand for PKI Private Key Protection
  • HSMoD for Oracle Database
  • HSM on Demand for Hyperledger

Bugs Fixed

• DPS-2501 - The UI does not identify an invalid hostname when creating a tenant, resulting in the user having to repeat the tenant creation process.
• DPS-2159 - When the service provider administrator edits an enterprise tenant, the tenant admin field displays empty.
• DPS-2487 - Editing the tenant account name does not update the heading on the log in page.
• DPS-2434 - Deleting a tenant when the tenant account was accessed using the search box fails.