Additional Fields are now Mandatory for Tenant Registration

The following fields are now mandatory for tenant registration:

• Address
• City
• ZIP Code
• State/Province/Region*

* Mandatory if Country is set to United States, Canada, or Australia

This change has been rescheduled to Tuesday February 8th 14:00 UTC to give customers more time to adjust their environments.

A knowledge base article with a full description of the change is available here. The article contains important information on mandatory changes for users on 10.0 or 10.1 client versions in North America.

This change introduces a new endpoint for validating the certificate status. Please ensure that operating systems hosting the client are able to validate the server certificate status (OCSP/CRL) using port 80. 

Ensure that these certificate revocation lists (CRLs) are accessible from the client machine prior to the planned change on Tuesday February 8th 14:00 UTC  to guarantee continuity of service.

Current CRL: http://crl.godaddy.com/gdig2s1-3235.crl
New CRL: http://crl.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crl
Platform CRL: http://crl3.digicert.com/ssca-sha2-g7.crl

Version 10.4.1 of the Luna HSM client is now available for download from the Thales Customer Support Portal.  This client supports hybrid usage of both Luna Cloud HSM services and the Luna HSM product line, as detailed in the Luna Cloud HSM Client User Guide.

• Download Luna HSM Client 10.4.1 for Windows
• Download Luna HSM Client 10.4.1 for Linux

Added

• Luna HSM Client 10.4.1 allows you to initialize a Luna Cloud HSM service using a domain secret imported from a red PED key. This allows you to clone objects between PED-authenticated Luna HSM partitions and Luna Cloud HSM enabling cloud backups and improving availability by adding Luna Cloud HSM to your HA groups. See Initializing a Luna Cloud HSM Service for more information.

Changed

The following Luna Cloud HSM service names have been changed:

• HSM on Demand is now Luna Cloud HSM
• HSM on Demand for CyberArk is now Luna Cloud HSM for CyberArk
• HSM on Demand for Digital Signing is now Luna Cloud HSM for Digital Signing
• HSM on Demand for Hyperledger is now Luna Cloud HSM for Hyperledger 
• HSM on Demand for Java Code Signer is now Luna Cloud HSM for Java Code Signer 
• HSM on Demand for Microsoft ADCS is now Luna Cloud HSM for Microsoft ADCS 
• HSM on Demand for Microsoft Authenticode is now Luna Cloud HSM for Microsoft Authenticode
• HSM on Demand for Microsoft SQL Server is now Luna Cloud HSM for Microsoft SQL Server 
• HSM on Demand for PKI Private Key Protection is now Luna Cloud HSM for PKI Private Key Protection 
• HSMoD for Oracle TDE is now Luna Cloud HSM for Oracle TDE 
• HSM on Demand with Key Export is now Luna Cloud HSM with Key Export

CipherTrust Key Broker for Google Cloud EKM service users can now access their DPoD platform tenant. Users can log in to their tenant hostname URL to access DPoD platform features such as User Management, Tenant Management, and Reporting.

CipherTrust Key Broker for Google Cloud EKM service tenants do not have access to tenant features such as Subscriber Groups or Adding Services.

Removed

The PATCH /tenants/{id}/admin/reset and POST /tenants/{id}/admin/resetMfaToken operations have been removed from the DPoD Platform API.

Service provider administrators can no longer reset the password or MFA token of a user inside of a child tenant.  Users can use the self-service resources in the DPoD platform or submit requests to an available administrator. See User Management for more information.

Changed

• Non-FIPS Luna Cloud HSM service firmware has been updated to version 1.4.2. Firmware version 1.4.2 provides various performance improvements and is an enabler for future marketplace services. See Luna Cloud HSM Services for more information about FIPS and non-FIPS services.

Deprecated

• The DPoD platform will remove the ability for a service provider administrator to reset a tenant administrators account password. Tenant administrators can use the self-service password reset from the DPoD tenant login screen or request that a sibling tenant administrator reset their password.

Bugs Fixed

• SH-4366 - Firmware version 1.4.2 for non-FIPS Luna Cloud HSM services disallows the creation of a key with both the "public" and "sensitive" attribute combination.  

Added

• Service Provider Administrator Platform Credentials. Platform credentials allow Service Provider Administrators to access and mange tenants, users, and reports using the DPoD API.

Changed

• "HSM on Demand Services" are now "Luna Cloud HSM Services"
• "Key Management on Demand Services" are now "CipherTrust Key Management Services"

Added

• Version 10.2 of the HSM service client is now available for download from Thales Data Protection on Demand. This client supports hybrid usage of both HSMoD services and the Luna HSM product line, as detailed in the HSM on Demand Client User Guide. Refer to the HSM Client 10.2 Customer Release Notes document for more information. See Upgrading your HSMoD Service Client for more information about updating your HSMoD service client. 
• HSM on Demand service clients now use JWT authentication. 
• The HSMoD service client is now supported on the following operating systems:
  • RHEL8/CentOS8
  • Windows Server 2019 (standard and core)
• You can configure additional logs (Application Error Logs and Curl Logs) in the application console. See the HSM on Demand Troubleshooting section for more information. 

Changed

• The new HSMoD service has updated entries in the REST and XTC sections of the crystoki.ini (Windows) and the Chrystoki.conf (Linux) configuration files. Refer to the Configuration File Summary for a description of the default options and additional settings. 
• Deleting a client from a JWT authenticated HSMoD service now revokes the client ID and client secret associated with that client. Create a new HSMoD service client for the service to resume access. See Managing HSMoD Services for more information about deleting a service client and revoking the service credentials. 

Removed

• Older Java versions are no longer supported. See the HSM Client 10.2 Customer Release Notes document for more information.
• If your application relies on Oracle Java 7 or Java 8, you must update the advanced version provided by Oracle. You require (at minimum) version 7u131 or 82u121. Please refer to the Oracle website for more information.
• If your application relies on IBM Java 7 or 8, do not update your service client.If you want to update your client software, consider adopting OpenJDK or another supported Java version See Supported Cryptographic APIs.

Bugs Found

• DPS-5531 - If you exit the Suggest An Edit feature, in the DPoD Platform documentation, using the Close button, you can no longer scroll the documentation page. Refresh the page to continue scrolling.
• DPS-5493 - The Rotation Policies section of the Salesforce Key Broker service do not display. There is no workaround at this time.
• DPS-5433 - Tenant administrator users cannot reset their password using the Actions column in the User Details table. Change your Tenant Administrator password by clicking Change password in the upper right corner of the DPoD UI. 
• SH-4987 - When creating a self-signed certificate with cmu selfsigncertificate, additional characters are added to the specified serial number. Use cmu getattribute to list the actual serial number assigned to the certificate.

Bugs Fixed

• Luna-11616 - LunaCM displays available slots if the client fails to resolve the DPoD service's hostname. Restart LunaCM to re-attempt the connection to the service.
• Luna-11447 - Resolved a segmentation fault stopping HA members from failing over to an HSMoD service.
• HOD-957 - The default log level in the client was updated to provide improved details. 

Changed

• Enforcing restriction of 100 token objects (or 50 RSA-2048 key pairs) per service. We recommend you remove any unused keys to comply with the 100 token object limit and improve HSM performance.