Thales Data Protection on Demand now collects audit logs for Luna Cloud HSM Services using client version 10.2 and newer. Users can generate audit log files and retrieve signed URLs for access to the audit log files using the Audit Query API /v1/audit-log-exports endpoint. Audit logs provide a record of the outcome of an action by an actor on a resource. 

For more information about Audit Logging see About the Audit Log API. 

A new certificate issuer will be used in the European data center for Luna Cloud HSM clients starting in August 2022.

A knowledge base article with a full description of the change is available here. The article contains important information on mandatory changes for users on 10.0 or 10.1 client versions.

This change introduces a new endpoint for validating the certificate status. Please ensure that operating systems hosting the client are able to validate the server certificate status (OCSP/CRL) using port 80. 

Ensure that these certificate revocation lists (CRLs) are accessible from the client machine prior to the planned change in August 2022 to guarantee continuity of service.

Current CRL: http://crl.godaddy.com/gdig2s1-3235.crl
New CRL: http://crl.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crl
Platform CRL: http://crl3.digicert.com/ssca-sha2-g7.crl

The firmware versions for Luna Cloud HSM Services operating in EU environments have been updated. The current firmware version based on region and FIPS mode are as follows:

• NA FIPS - 1.4.0
• NA non-FIPS - 1.4.2
• EU FIPS - 1.5
• EU non-FIPS - 1.6 

FW 1.5 includes improvements to the Point to Point encryption service. FW 1.5 also includes the following bug fixes:

• SH-4366 - The firmware can create but not import public+sensitive keys. You must specify both CKA_PRIVATE=1 and CKA_SENSITIVE=1 Key Attributes for all Generated, Derived and Unwrapped keys
• SH-5322 - The firmware crashes when cancelling a multi-part operation. The firmware no longer crashes when cancelling a multi-part operation.
• SH-5595 - Deriving x9.42 DH2 returns CKR_OBJECT_HANDLE_INVALID. Deriving x9.42 DH2 no longer returns CKR_OBJECT_HANDLE_INVALID

FW 1.6 includes all of the improvements from FW1.5 and additional enhancements.

This change has been rescheduled to Tuesday February 8th 14:00 UTC to give customers more time to adjust their environments.

A knowledge base article with a full description of the change is available here. The article contains important information on mandatory changes for users on 10.0 or 10.1 client versions in North America.

This change introduces a new endpoint for validating the certificate status. Please ensure that operating systems hosting the client are able to validate the server certificate status (OCSP/CRL) using port 80. 

Ensure that these certificate revocation lists (CRLs) are accessible from the client machine prior to the planned change on Tuesday February 8th 14:00 UTC  to guarantee continuity of service.

Current CRL: http://crl.godaddy.com/gdig2s1-3235.crl
New CRL: http://crl.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crl
Platform CRL: http://crl3.digicert.com/ssca-sha2-g7.crl

Version 10.4.1 of the Luna HSM client is now available for download from the Thales Customer Support Portal.  This client supports hybrid usage of both Luna Cloud HSM services and the Luna HSM product line, as detailed in the Luna Cloud HSM Client User Guide.

• Download Luna HSM Client 10.4.1 for Windows
• Download Luna HSM Client 10.4.1 for Linux

Added

• Luna HSM Client 10.4.1 allows you to initialize a Luna Cloud HSM service using a domain secret imported from a red PED key. This allows you to clone objects between PED-authenticated Luna HSM partitions and Luna Cloud HSM enabling cloud backups and improving availability by adding Luna Cloud HSM to your HA groups. See Initializing a Luna Cloud HSM Service for more information.

Added

• Version 10.3 of the HSM service client is now available for download from Thales Data Protection on Demand. This client supports hybrid usage of both Luna Cloud HSM services and the Luna HSM product line, as detailed in the HSM on Demand Client User Guide. See Upgrading your Luna Cloud HSM Service Client for more information about updating your Luna Cloud HSM service client.

Bugs Found

• LUNA-14009 - Executing cmu verifyhsm does not prompt the user to enter a challenge string. Always specify a challenge string using cmu verifyhsm -challenge <string>.
• LUNA-13907 - Requesting a certificate using cmu requestcertificate using the wrong attribute to specify the private key returns an incorrect error message. Use the -privateouid to specify a private key on a Luna Cloud HSM service.
• LUNA-13780 - Executing cmu import to import a DSA key fails. Use an RSA public key instead.
• LUNA-13761 - Executing cmu selfsigncertificate with no arguments specified, on Linux, cmu fails to prompt the user for the relevant object handles/OUIDs. Always specify the object handles/OUIDs using -publichandle and -privatehandle or -publicouid and -privateouid.
• LUNA-12822 - ckmdeo option Get OUID (39) returns OUIDs with extra zeroes appended. Use option Get Attribute (24) to view the correct OUID.
• LUNA-11269 - In HA configurations, where a Luna Cloud HSM service is configured as a standby, some events (such as when a connection drops and recovers due to a timeout when contacting the service) are not recorded in the HA log file.
• SH-5595 - Deriving X9.42 DH2 keys returns CKR_OBJECT_HANDLE_INVALID. We recommend you avoid upgrading your Luna Cloud HSM service client until the issue is resolved. 
• SH-4194 - Executing cmu getpkc to confirm a public key can fail. Execute the ckdemo Display Object (27) function to confirm the key pairs origins and security in the HSM. If the CKA_NEVER_EXTRACTABLE attribute is present it confirms that the private key was created in the HSM and has never been extracted.

Bugs Fixed

• SH-4987 - The displayed serial numbers of self-signed certificates created using cmu selfsigncertificate now match the input serial number.

Added 

• Subscriber tenant administrators can complete the Add Service Elections Form, a separate commitment from the Initial Service Elections Form, to demonstrate additional service commitments to their service provider.

Bugs Found

• DPS-6769 - The Salesforce Key Broker service does not update the Last Modified At and Modified By columns in the Service Details tables when service secrets are updated.

Bugs Fixed

• DPS-6737 DPoD Terms of Service now display correctly in the Safari browser. The DPoD Terms of Service are always available from the support portal. 
• DPS-6761 - If the DPoD user interface cannot display the Salesforce Secret Type, the DPoD user interface will display the Salesforce value. 

Added

• The CipherTrust Key Broker for Google Cloud EKM service is now available. Register for the service through the Google Marketplace to gain access to an HSM secured key encryption key for use as a wrapping key in Google Cloud EKM. Access the service documentation for more information about the CipherTrust Key Broker for Google Cloud EKM service.

Bugs Found

• EKMS-652 - The Add Key Ring button is disabled in the CipherTrust Key Broker for Google Cloud EKM service if you attempt to create a Key Ring without first adding an EKM Policy. Create an EKM Policy before adding a Key Ring.
• EKMS-659 - The CipherTrust Key Broker for Google Cloud EKM dashboard URL shows a 404.  Access the CipherTrust Key Broker for Google Cloud EKM log in page and enter the FQDN of your CipherTrust Key Broker for Google Cloud EKM dashboard to log in.
• DPS-5823 - New service clients created in the North America (NA) environment cannot connect to a service on Windows Server 2012r2 operating systems.

Added

• Version 10.2 of the HSM service client is now available for download from Thales Data Protection on Demand. This client supports hybrid usage of both HSMoD services and the Luna HSM product line, as detailed in the HSM on Demand Client User Guide. Refer to the HSM Client 10.2 Customer Release Notes document for more information. See Upgrading your HSMoD Service Client for more information about updating your HSMoD service client. 
• HSM on Demand service clients now use JWT authentication. 
• The HSMoD service client is now supported on the following operating systems:
  • RHEL8/CentOS8
  • Windows Server 2019 (standard and core)
• You can configure additional logs (Application Error Logs and Curl Logs) in the application console. See the HSM on Demand Troubleshooting section for more information. 

Changed

• The new HSMoD service has updated entries in the REST and XTC sections of the crystoki.ini (Windows) and the Chrystoki.conf (Linux) configuration files. Refer to the Configuration File Summary for a description of the default options and additional settings. 
• Deleting a client from a JWT authenticated HSMoD service now revokes the client ID and client secret associated with that client. Create a new HSMoD service client for the service to resume access. See Managing HSMoD Services for more information about deleting a service client and revoking the service credentials. 

Removed

• Older Java versions are no longer supported. See the HSM Client 10.2 Customer Release Notes document for more information.
• If your application relies on Oracle Java 7 or Java 8, you must update the advanced version provided by Oracle. You require (at minimum) version 7u131 or 82u121. Please refer to the Oracle website for more information.
• If your application relies on IBM Java 7 or 8, do not update your service client.If you want to update your client software, consider adopting OpenJDK or another supported Java version See Supported Cryptographic APIs.

Bugs Found

• DPS-5531 - If you exit the Suggest An Edit feature, in the DPoD Platform documentation, using the Close button, you can no longer scroll the documentation page. Refresh the page to continue scrolling.
• DPS-5493 - The Rotation Policies section of the Salesforce Key Broker service do not display. There is no workaround at this time.
• DPS-5433 - Tenant administrator users cannot reset their password using the Actions column in the User Details table. Change your Tenant Administrator password by clicking Change password in the upper right corner of the DPoD UI. 
• SH-4987 - When creating a self-signed certificate with cmu selfsigncertificate, additional characters are added to the specified serial number. Use cmu getattribute to list the actual serial number assigned to the certificate.

Bugs Fixed

• Luna-11616 - LunaCM displays available slots if the client fails to resolve the DPoD service's hostname. Restart LunaCM to re-attempt the connection to the service.
• Luna-11447 - Resolved a segmentation fault stopping HA members from failing over to an HSMoD service.
• HOD-957 - The default log level in the client was updated to provide improved details.