Fixed Issue: Resolved a problem that prevented some users from viewing Luna Cloud HSM snapshots. This fix enhances the user experience and ensures that all snapshots are accessible as intended.
Fixed Issue: Resolved a problem that prevented some users from viewing Luna Cloud HSM snapshots. This fix enhances the user experience and ensures that all snapshots are accessible as intended.
As part of our ongoing infrastructure improvements, the One Welcome Identity Platform, which is used for authenticating users and Luna Clients, will be transitioning to use a new Certificate Authority (CA) in the upcoming weeks. The exact timing for this change will be posted in a maintenance window on the DPoD status page.
This change will be largely transparent to the majority of users. However, we would like to draw particular attention to users of the Luna Cloud HSM service. It is imperative to ensure that the Certificate Revocation List (CRL) distribution points for the Globalsign CA (http://crl.globalsign.com/) are accessible to your client to maintain uninterrupted service.
For a detailed overview of the network requirements for the Luna Cloud HSM service, please refer to the Client Network Connectivity documentation available on thalesdocs.com
Should you have any questions or require further clarification regarding this change, please do not hesitate to contact our support team.
The new Luna Cloud HSM Snapshot feature is now available to all users. Service snapshots allow Luna Cloud HSM users to restore their service partition to a previous snapshot to recover from zeroization or accidental deletion of keys. A snapshot is a complete capture of the state of the partition that includes all partition objects, (e.g keys and certificates), as well as the current state of credentials for partition users.
Luna Cloud HSM Service snapshots are introduced with the following supported items:
See Service Snapshots for creating, deleting and restoring information.
The public endpoints GET /v1/backoffice/accountStatuses and GET /v1/backoffice/accountStatuses/{id}are deprecated and will be removed in a future release.
If you rely on them to know the status of a Tenant under your Service Provider, or for your own Tenant regarding the existence of an initial Service Election, you can use GET /v1/backoffice/serviceAgreements/{tenantId}to get the same information to determine if an initial Service Election has been submitted, approved or expired.
NOTE: The GET /v1/backoffice/subscriptions endpoint returns a list of existing subscriptions for:
…but not for any particular requested subscription.
The Luna Cloud HSM Client Deprecation List has been updated to reflect the latest versions that are available for continued support. It is recommended to update to the latest supported client as soon as possible to avoid service disruptions.
This is the link to the updated Deprecated List.
The Thales Data Protection on Demand Terms of Service has been updated and is now included in the Thales Cyber Security Products End User Agreement.
Please review the updated terms at its new location, https://cpl.thalesgroup.com/legal, for more information.
In addition to the list at https://thalesdocs.com/dpod/resources/client_resources/network_connectivity/index.html#certificate-authority-crls-and-ocsps users of the Luna Cloud HSM service are advised to whitelist the following URLs for the Google Certificate Authority CRL and OCSP instead of the specific URL.
http://c.pki.goog/ http://o.pki.goog/
Recent changes to the certificates mean the previous specific crl url in the documentation is no longer correct however the documentation has now been updated to reflect the correct crl url. If the client is unable to download the Certificate Revocation List, the client will return an error: "The revocation function was unable to check revocation because the revocation server was offline."
The Luna Cloud HSM client bundle is updated to include the 10.8.0 Universal Client. Users are encouraged to upgrade to this latest client version and ensure it is supported in accordance with the Universal Client Supported Versions with Luna Cloud HSM table.
See Upgrade Client for more information about upgrading your client.
Changed
The `AuthTokenConfigURI` parameter in the Chrystoki.conf and crystoki.ini configuration file is updated to directly reference the updated endpoint that comes as the result of the migration to the One Welcome Identity Platform.
Client version 10.8.0 will be required for hybrid HA group operations between Luna Network HSM and Luna Cloud HSM when the Luna Cloud HSM service is upgraded to FW 3.0.
Bugs fixed
Resolved an issue in the 10.7.2 client where the command cmu verifyhsm fails.
Resolved an issue with previous versions of the support tool "lch-support-linux-64bit" and "lch-support-win-64bit" that generated false failures as a result of differences with the One Welcome Identity Platform.
Firmware 3.0 will be released from Thales Data Protection on Demand for Luna Cloud HSM services in two stages.
The first release of Firmware 3.0 will be available by the end of the second half of 2025 and will be a non-FIPS release.
The second release of Firmware 3.0 will be available by the end of the second half of 2026 and will be a FIPS certified release.
See Firmware 3.0 CRN for more information about the new features and enhancements for firmware 3.0. Due to new requirements in the FIPS 140-3 certification there are numerous changes incorporated with this release.
-> After upgrading to FW 3.0, Hybrid HA operations with a Luna Network HSM will require Luna Client UC10.8.0 or higher. Using a client version prior to 10.8.0 will result in CKR_FUNCTION_NOT_SUPPORTED returned when attempting to login to a Hybrid HA group.
-> CPv1 has been removed from FIPS firmware support as it is no longer compliant with 140-3. As this only affects FIPS mode, all affected users should use CPv4 or transition service to non-FIPS mode.
-> The user can now update the ECC curves without disabling the policy on FW upgrade if the module is configured in ‘FIPS mode’.
Changes due to FIPS 140-3 Certification
-> All pre-hashed verify operations will be blocked.
-> RSA-based key transport schemes that use only PKCS#1-v1.5 padding are disallowed, notably the mechanism CKM_RSA_PKCS for encrypt/decrypt/wrap/unwrap. Other mechanisms might now prohibit forward operations (new encryption or signing or wrapping,) while continuing to permit others (decrypt/unwrap) to support legacy situations.
-> Signature creation for Curve448 and Curve25519 (ECDH) are blocked.
-> Cloning encryption is now ECC-based (formerly RSA).
-> EFP/EFT is now mandated at Level 3 for FIPS 140-3.
-> New restrictions have been added to some mechanisms when the HSM is in FIPS mode. (See Firmware 3.0 CRN for complete list.)
The following error messages are appearing when "partition showinfo" is run in lunacm:
0x82 (CKR_OBJECT_HANDLE_INVALID)
SMK OUIDs are not available
These errors are appearing in FW 3.0 however it does not affect the performance of the release. This has not appeared in previous FW releases.
Thales Data Protection Demand has updated the Identity Provider (IDP) used in the DPoD platform to Thales OneWelcome Identity Platform in the Europe region. The North America region was migrated on February 22nd, 2025.
This update enables the platform to provide modern authentication options to users while simplifying logins for users that manage multiple tenants on the platform. Feature updates include:
North America users can now access DPoD through the login portal at https://welcome.dpondemand.io. You will need to register a new MFA token on the initial login.
We recommend that all Luna Cloud HSM users download a new client to ensure continued connection and performance following the migration. For more information see Upgrade Client. If you have additional questions about the migration see the DPoD IDP Migration FAQ.
Please be aware of the following known issue when using the new login portal:
Issue: During the login process TOTP authentication can fail and the error message: "Service temporarily unavailable, please try again later" displays.
Workaround: Click Go back in the user interface and reenter the TOTP or enter a new TOTP.
