Release Notes

Product Description

CipherTrust Manager is the center of the CipherTrust Data Security Platform. It serves as the central point for managing configuration, policy and key material for data discovery, encryption, on-premise and cloud based use cases. It is the successor to both the Thales eSecurity (formerly Vormetric) DSM and the Gemalto (formerly SafeNet) KeySecure platforms.

Product Abbreviations

Release Description

This release is available on the Customer Support Portal in the following formats:

2.13.3 release

• An upgrade file for k470 appliances, Thales CipherTrust Manager k570 appliances, and all existing k170v Virtual CipherTrust Manager instances.

  Warning

  This release is not supported on Thales TCT k160 devices or Thales TCT CipherTrust Manager k570 devices.

2.13.2 release

• An upgrade file for k170v Virtual CipherTrust Manager instances on Google Cloud Platform only. This upgrade is not supported on any other private or public clouds.

2.13.1 release

• An upgrade file for k470 appliances, Thales CipherTrust Manager k570 appliances, and all existing k170v Virtual CipherTrust Manager instances.

  Warning

  This release is not supported on Thales TCT k160 devices or Thales TCT CipherTrust Manager k570 devices.

• An OVA image file for deploying a new Virtual CipherTrust Manager on VMWare vSphere or Nutanix AHV.

• A VHDX image file for deploying a new Virtual CipherTrust Manager on Microsoft Hyper-V.

• A QCOW2 image file for deploying a new Virtual CipherTrust Manager on OpenStack.

In addition, 2.13.x Virtual CipherTrust Manager will be available on the following public clouds, as the Community Edition:

• Amazon Web Services: SafeNet Cloud Provisioning System

• Google Cloud

  Note

  As 2.13.x is not the default version, you must use the gcloud CLI to retrieve it.

• Microsoft Azure: Available as a BYOL image in the Microsoft Azure Marketplace

• Oracle Cloud

• IBM Cloud

  • An OVA image file for deploying a new Virtual CipherTrust Manager on IBM Cloud VMWare.

  • A QCOW2 image file for deploying a new Virtual CipherTrust Manager IBM Cloud Virtual Private Cloud Gen2.

2.13.x contains a number of new features and enhancements. Refer to Features and Enhancements for details. For the list of known issues, refer to Known Issues.

Features and Enhancements

Release 2.13.3

The 2.13.3 release includes an internal client upgrade to maintain compatibility with the Thales Data Protection On Demand (DPoD) Luna Cloud HSM Service root-of-trust integration past January 28, 2025. Details on the Luna Cloud HSM compatibility change are available in knowledge base article KB0028422. The CipherTrust Manager change is tracked internally under reference number KY-85443.

This release is available as an upgrade file. The upgrade can be applied directly on CipherTrust Manager versions 2.10.x, 2.11.1, 2.12.x, 2.13.1 and 2.13.2.

This release does not address all security vulnerabilities discovered after the release of 2.13.0 minor version. To obtain current security fixes, upgrade to the latest feature release.

Release 2.13.2

The 2.13.2 release includes a stability fix for Virtual CipherTrust Manager disk resizing on Google Cloud Platform. The fix is described in the resolved issues list. This release is available as an upgrade file and only supported for Virtual CipherTrust Manager instances running on Google Cloud Platform. The upgrade can be applied directly on CipherTrust Manager version 2.13.1.

Release 2.13.1

The 2.13.1 release includes a stability fix for the Virtual CipherTrust Manager license. The fix is described in the resolved issues list. This release is available as a new virtual instance, or as an upgrade file. The upgrade can be applied directly on CipherTrust Manager versions 2.13.0, 2.12.x, 2.11.0, 2.11.1, and 2.10.x.

Release 2.13.0

Platform

• Added support in the Connection Manager to configure CipherTrust Manager as an external key source for CCKM.

• Added provision to set the state of the previous version of the key to either "protectstop" or "deactivated" after rotation using the "replaced-key-state" parameter. The key state "protectstop" is mapped to restricted and "deactivated" to "retired" in NAE.

• Support for AWS IAM roles anywhere in the Connection Manager for CCKM.

• Added UI support for renewing an interface certificate and local Certificate Authority (CA) certificate.

• Added provision in the Update /v1/vault/keys2/{id} API to modify the "Key Usage" for all versions of a versioned key in one go.

• Added option to allow users to specify key owner during DSM restore.

• Connection Manager support for SFDC using "client_credentials OAuth grant type" through API and CLI.

• Added support for multiple IPs in DNS host record. It enables outbound requests from the CipherTrust Manager to be scattered over multiple IPs in a round-robin fashion.

• Added user_member_field and group_dn_attribute fields to support different LDAP Schemas in LDAP-connection manager through API and CLI. Also, fixed DSM parities for Platform CTE LDAP Browsing.

• Added provision to send SMTP notifications for system alarms.

• Auto-execution support added for AddUserToGroup quorum.

• Enhanced UI, API, and CLI for key management by adding a "description" field.

• Added UI options to upload license and certificate files where needed, in addition to existing options to paste in text values.

• Added an option to disable automatic creation of a user for OIDC and LDAP connections in Access Management.

• Added a UI option to set a saved query as the default query for Loki Audit Records.

• Added ability to download Loki Audit Records to a JSON file.

• Added more UI options to finely control key rotation schedule. Which keys are rotated can be determined relative to the time the scheduled job runs.

• Enhanced client profile and registration token UI menus to provide better control of CA configuration.

  Note

  The Client Profiles page on the CipherTrust Manager GUI is labeled Tech Preview as it will continue to expand further. However, any feature that uses this page is not affected by the label.

• The GUI flow to create registration tokens has changed. When creating a registration token, you now need to select a pre-created client profile instead of selecting a CA.

  Note

  • If you automate registration token creation using the /api/v1/client-management/regtokens API endpoint, it is recommended to provide value for the client_management_profile_id attribute that points to an existing client profile.

  • This is not enforced for backward compatibility reasons.

Limitations

• The support for ProtectV is removed from the CipherTrust Manager, so when you upgrade from CipherTrust Manager 2.11 or lower versions, the ProtectV Admins, ProtectV Clients, and ProtectV Users groups still show up but are not usable. These groups can be manually removed if required.
  However, when you upgrade a fresh CipherTrust Manager 2.12 to 2.13 or higher, this issue is fixed and groups are not visible.

• If a domain has more than 1000 cryptographic objects (keys and opaque objects), to fetch keys, it is recommended to use KeyNamesRequest instead of KeyQueryRequest. The response time of KeyQueryRequest is proportional to the number of keys on the CipherTrust Manager, therefore, it may lead to a timeout exception on the client side.

• Currently, the log forwarders are not configured to use the system's proxy configuration. If proxy is configured, the log forwarders bypass the proxy servers.

• The backup and restore of users and groups in a domain only works among the domains of different CipherTrust Managers. This feature does not support backup and restore among different domains of the same CipherTrust Manager.

• During client renewal, if another client (which has authentication_mode mode set to dn) already exists in the system with a matching subject DN, the client renewal may fail. This applies to external or local CA clients. For external CA certificates, delete the client to be renewed and register a new client with a new certificate and different subject DN.
  However, for local CAs, it is not required to delete the client to be renewed, rather set the do_not_modify_subject_dn field to false. Refer to Renewing Local CA Clients for details.

Application Data Protection

• Added support of internal, external, and disable versioning in protection policy.

• Added option to clean erroneous clients.

• Added provision to view client versions in application.

CCKM

• [Public Preview]: Added support for OCI HYOK to manage external vaults and external keys.

• Added UI support for CCKM integration with Google Cloud KMS for the use EKM key management with EKM via VPC connections to create, rotate, and destroy coordinated external keys in CCKM cryptospaces. Note that these keys can only be managed through the Google Cloud KMS (and not through CipherTrust Manager or CCKM).

• From the CCKM UI, you can now enable or disable audit recording of successful operations within an AWS external key store. Note that enabling this feature significantly impacts the performance of the key store. Enable this feature only for the purpose of troubleshooting or presenting a demo.

• From the CCKM UI, CCKM administrators can now manage user and group permissions on Google Cloud projects to allow users and groups to manage Google cryptospaces and cryptospace endpoints.

• Added support to check the health of the connection between a CipherTrust Manager node and an HSM, which are deployed behind a load balancer, using the Health Check URI Path value.

• You can now assign a credential rotation schedule for the credentials of a given external custom key store in CCKM. You also now have the ability to assign or unassign a credential rotation schedule for these credentials in CCKM. The key store must be in a linked state, which allows the auto rotated (new) credentials to be updated in AWS KMS.

• In this release, AWS health check response includes the status of an external custom key store, which uses a Luna HSM or a CipherTrust Manager as a key source. This health check validates whether the key store is available, working, and ready to handle requests.

• CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING, a new Key Access Justification (KAJ) reason, is now available for use by the Key Access Justifications feature in Google Cloud. When justification reasons are set, they need to be provided for Google Cloud EKM to initiate a wrap or unwrap operation.

• Added support for external CipherTrust Manager as a key source.

• Added support to migrate source keys from DSM to an external CipherTrust Manager while migrating to CipherTrust Manager (CCKM embedded) for cloud key management.

• Added new options to manage SFDC connections on the CipherTrust Manager. Added support for Multifactor Authentication (MFA) for SFDC cloud.

• Added support for AWS IAM Roles Anywhere.

• Added capability to manage GCP key policies using the API.

• Added support for AWS bulk jobs to perform enable and disable operations on multiple AWS keys in one attempt through the GUI. A maximum of 100 keys are supported for bulk operations.

• [Google Workspace CSE]:

  • Enhanced the wrapPrivateKey API for Gmail.

  • Implemented changes to accommodate the renamed privilegded unwrap API (from privileged_unwrap to privilegedunwrap per the latest Google spec 0.9.2).

CTE and CTE UserSpace

Information in this section applies to all types of CTE and CTE UserSpace Agents unless stated specifically.

• Support for configuration of CTE Agents to communicate with a CipherTrust Manager cluster behind a network load balancer.

• Reintroduced support for the Unique to Client Keys. Support for these keys was suspended in the CipherTrust Manager 2.12 release.

• Extended quorum control support for the following new operations:

  • DeleteCSIStorageGroupCTE

  • DeletePolicyCTE

  • DeletePolicyElementsCTE

  • DeleteProfileCTE

  • UpdateCSIStorageGroupCTE

  • UpdateGuardPointCTE

  • UpdatePolicyElementsCTE

  • UpdateProfileCTE

• GUI enhancements:

  • Added the Description field to the CTE reports pages.

  • Enhanced GUI to filter members while adding LDAP members to a user set over LDAP connections. You can also specify an LDAP Query to filter members meeting specific criteria.

CTE Specific

• Added support for migration of CTE resources shared across DSM domains.

• Removed GuardPath restrictions for Windows clients. CTE for Windows now supports protection of the following folders that contain open files:

  • The top-level Program Data folder on Windows Vista and Windows 2008

  • The top-level Documents and Settings folder on all other Windows platforms

  • The Users folder

• Included three Ransomware Protection licenses for the CipherTrust Manager Community Edition.

Notes on CTE UserSpace

CTE UserSpace is a kernel-independent file encryption product. The resources of CTE UserSpace clients running 10.0 and higher Agent versions are managed by the Transparent Encryption application on the CipherTrust Manager. These clients can't be managed by the ProtectFile & Transparent Encryption UserSpace application.

This release does not support the following features:

• Kernel Compatibility Matrix

• Agent and System locks

• CBC and XTS keys

• COS, ESG, IDT, and LDT policies and GuardPoints

DDC

Search for Secrets - This capability allows customers to discover secrets, like password and tokens, that are key to access secured elements such as apps, intellectual property, or infrastructure. Secrets can be misplaced in local hosts, databases or cloud locations that are not secured. Finding where secrets are located provides the opportunity to reduce or avoid the risk of exposure. This feature brings 23 new infotypes under the new classification profile 'Secrets'.

Resolved Issues

This table lists the issue resolved in 2.13.2

This table lists the issue resolved in 2.13.1

This table lists the issues resolved in 2.13.0.

Advisory Notes

This section highlights important issues you should be aware of before deploying the CipherTrust Manager. There is also a full list of known issues associated with the release.

USB Host Logs are Not Immediately Forwarded on Upgrade

If you have an existing syslog forwarder configured for host logs, and upgrade to 2.13, the USB host logs are not immediately forwarded. You need to manually force the syslog forwarder to update completely. This can be achieved by:

• Using the modify command.

  1. Use kscfg syslog forwarder modify --id <syslog_forwarder_id> --<another_option> <temporary_value> force the update.

  2. Use kscfg syslog forwarder modify --id <syslog_forwarder_id> --<another_option> <original_value> to reset to the original value.

• Deleting and recreating the syslog forwarder.

  1. View the syslog forwarder's current configuration values with kscfg syslog forwarder get --id. Note down or otherwise retain these configuration values.

  2. Delete the existing the syslog forwarder with kscfg syslog forwarder delete --id <syslog forwarder_id>.

  3. Re-create the syslog forwarder with kscfg syslog forwarder add, including any options necessary to set the original configuration values. These options are documented here.

NextGen KeySecure and ProtectFile End-of-Support in 2023

NextGen KeySecure firmware and the ProtectFile connector will be End of Support in December 2023.

In most cases, you can upgrade from NextGen KeySecure to CipherTrust Manager directly. If you are running the legacy k450 or k460 hardware model, you must migrate data to the k470 or k570 model.

We strongly recommend migrating ProtectFile to CTE or CTE Userspace.

Luna Network HSM 5.x and 6.x are no longer supported as Root-of-Trust for CipherTrust Manager

As Thales has passed the end-of-support date for Luna Network HSM 5.x and 6.x, CipherTrust Manager no longer supports those versions for root of trust. CipherTrust Manager does not enforce against setting up those versions for root-of-trust, so upgrading will not disrupt existing root-of-trust connections to our knowledge. Consult the End of Sale and End of Support announcement, Luna Network HSM 7 documentation, and Data Protection on Demand and Luna Cloud HSM documentation for migration information.

Quorum

Do not enable quorum on the ManagePolicyAttachment and DeletePolicy operations until all the CipherTrust Manager nodes in a cluster are upgraded to 2.10 or a higher version.

SMB Connection

The Host and Port fields must be specified together, or do not specify any of them. If Host and Portare not specified while creating an SMB connection, these fields cannot be added later.

Recommendation for Secure Initialization Vector in DESede CBC, AES CBC, and AES GCM Encryption Requests

When generating a new AES or DESede key CipherTrust Manager currently generates and stores a Default IV associated with the new key. This is mainly used to support specific legacy integrations and applications.

We strongly recommend future crypto applications use a secure, unique initialization vector (IV) for each AES CBC, AES GCM, and DESede CBC encryption request, rather than relying on a default IV provided by CipherTrust Manager for the security of your data. For example, unpredictable, unique IVs for AES CBC requests protect against oracle attack techniques such as ROBOT, DROWN, POODLE, and BEAST.

We recommend to use CipherTrust Manager's random number generation to produce secure IVs, or you can provide your own IV with each AES CBC, AES GCM or DESede CBC encryption request following the security guidelines for constructing secure IVs in NIST SP800-38A and NIST SP800-38D.

In the KMIP interface, always set the RandomIV object in the Cryptographic Parameters attribute to true or provide your own secure IV in the Request Payload as an IV/Counter/Nonce object.

In the REST and NAE interfaces, use CipherTrust Manager's random number generation to produce secure IVs for cryptographic requests, or provide your own secure IV.

Some Key States Change After Upgrade

After upgrade from 2.4 some key states are remapped as a result of harmonizing NAE-only key states. In most cases, the allowed operations for a key remain the same before and after upgrade, so key usage is not disrupted.

As you cannot upgrade directly from 2.4 to 2.13, these changes take effect when you first upgrade from 2.4 to an intermediate minor version, 2.5, 2.6, or 2.7.

• When a key has an NAE state of Retired and the deactivation date is set in the future, the key is set to Deactivated immediately upon upgrade. No cryptographic operations are allowed.

• When a key has an NAE state of Restricted and Protect Stop Date is set in future, the key is set to Active and the Protect Stop Date is set to the current time. Decryption, signature verification, unwrapping, and MAC verification are allowed.

• When a key has an NAE state of Active and Activation Date is not set, the activation date is set to the current time. All cryptographic operations are allowed.

• When a key has an NAE state of Active and Activation Date is set in the future, the key is set to a Pre-Active state and the Activation Date is retained. No cryptographic operations are allowed until the Activation Date is reached.

• When a key has a state of Deactivated before upgrade, its state will be unchanged after upgrade. However, the allowed operations for the Deactivated state change after upgrade. The key loses its ability to decrypt, verify signatures, unwrap, and verify MACs. You can re-activate the key after upgrade and set the ProtectStop date to restore those operations.

System Upgrade and Downgrade Supported Releases

System upgrades on a single unclustered device to 2.13.1, has been tested from 2.13.0, 2.12.x, 2.11.0, 2.11.1, and 2.10.x. For 2.13.2, we tested upgrade from 2.13.1. For 2.13.3, we tested upgrade from 2.13.0, 2.13.1, 2.13.2, 2.12.x, 2.11.0, 2.11.1, and 2.10.x.

An unclustered CipherTrust Manager can be downgraded to the previous minor version. For release-specific upgrade/downgrade information, refer to the release notes for your release.

Refer to the System Upgrade page for instructions to perform an upgrade or downgrade.

The cluster upgrade section provides instructions to perform an upgrade on a cluster of devices. Supported upgrade paths depend on the method used to upgrade the cluster.

• Cluster remove/rebuild to 2.13.1 is supported from 2.10.x, 2.11.0, 2.11.1, 2.12.x, and 2.13.0. Cluster remove/rebuild to 2.13.2 is supported from 2.13.1. Cluster remove/rebuild to 2.13.3 is supported from 2.10.x, 2.11.0, 2.11.1, 2.12.x, 2.13.0, 2.13.1, and 2.13.2.

• In-place cluster upgrade is performed from one minor version at a time, so there is no limit on starting version. You must upgrade to 2.13.1 before you can upgrade to 2.13.2.

Restoring a backup from release 2.10.0 or later is supported; however, restoring a newer backup to an older version is never supported.

Protect the ksadmin Private SSH Key

The private SSH key for the ksadmin account is critical to system security and must be carefully protected. Failure to do so could allow an attacker to compromise the system.

TLS/SSL Must be Enabled in a Production System

As it may be useful for troubleshooting, it is possible to disable TLS/SSL for the NAE interface. This will lead to an insecure system. Therefore, TLS/SSL should always be enabled for a production system.

Key Usage Mask Selection

If you want to perform any operation (for example, Wrap/Unwrap) from the NAE/KMIP connector, set the usage mask explicitly for that operation while creating keys through UI.

DDC

Clusters

• Only one CipherTrust Manager node in the cluster can have DDC activated. To access DDC, create a new DNS entry to point to the active CipherTrust Manager node.

• DDC functionality cannot be accessed through the CipherTrust Manager FQDN. DDC requests sent to an inactive CipherTrust Manager node fail (and return the impression that DDC fails randomly).

Licensing

Overlapping licenses are not supported (except for the trial license).

Upcoming End of Support for Platforms and Features

• Linux 2.4 Node Agents

• Email Targets - Microsoft Exchange (EWS)

• Microsoft 365 - Exchange Online (EWS)

• Web Browser - Internet Explorer

Compatibility

This section documents known compatibility topics to be considered before deploying the CipherTrust Manager.

TLS Compatibility

This table identifies the supported TLS versions for each of the CipherTrust Manager interfaces. The default minimum value reflects the default minimum_tls_version setting. This setting controls the lowest acceptable TLS version allowed for connections to the interface.

By default, CipherTrust Manager accepts the following ciphersuites for TLS 1.2+ connections:

• TLS_AES_256_GCM_SHA384 (TLSv1.3)

• TLS_CHACHA20_POLY1305_SHA256 (TLSv1.3)

• TLS_AES_128_GCM_SHA256 (TLSv1.3)

• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS Deprecation Notices

• Use of TLS 1.0 and 1.1 protocols is deprecated. This support will be discontinued in a future release. Upgrade all applications connecting to CipherTrust Manager interfaces to TLS 1.2 or higher as soon as feasible.

• Use of the following CBC-based ciphersuites is deprecated, and support will be discontinued in a future release:

  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

  • TLS_RSA_WITH_AES_256_CBC_SHA

  • TLS_RSA_WITH_AES_128_CBC_SHA

Client Platforms

The following client Platforms are supported by the CipherTrust Manager.

CipherTrust Application Data Protection

• CADP for .NET Core: minimum version 8.11.0

• CADP for C: minimum version 8.14.0

• CADP for Java: minimum version 8.13.0

CipherTrust Application Key Management

• CAKM for Oracle TDE: minimum version 8.10.0

• CAKM for Microsoft SQL Server EKM: minimum version 8.5.0

CipherTrust Cloud Key Manager

Minimum version 1.6.3.20532

CipherTrust Database Protection

• CDP for Oracle: minimum version 8.12.0

• CDP for MSSQL: minimum version 8.12.0

• CDP for DB2: minimum version 8.12.0

• CDP pdbctl: minimum version 1.5.1

• CipherTrust Teradata Protection: minimum version 6.4.0.12

• Transformation Utility: minimum version 8.4.3

CipherTrust Transparent Encryption

Minimum version 7.0.0

CipherTrust Transparent Encryption UserSpace

Minimum version 10.0

CipherTrust Transparent Encryption for Kubernetes

Minimum version 1.0.0

CipherTrust Vaulted Tokenization

Minimum version 8.7.1

CipherTrust Batch Data Transformation

Minimum version 2.2.0.2816

CipherTrust Vaultless Tokenization

Minimum version 2.5.2.19

ProtectFile

Minimum version:

• ProtectFile Windows 8.12.3

• ProtectFile Linux 8.12.3, 8.12.4p02 (for migration to CTE)

The latest three GA versions of ProtectFile are tested with CipherTrust Manager. Older versions are expected to work, but they are not tested explicitly.

Data Discovery and Classification Agents

Linux minimum kernel version is 2.6.

There are no changes in Agent requirements if you are upgrading from CM 2.4 to 2.5.1. If you are upgrading from a version older than 2.4 please refer to Upgrading Agents.

TDP Version Compatibility

Data Discovery and Classification requires TDP 3.1.5.1 or newer.

• If you have an existing TDP 3.1.5 cluster, you should apply the patch 3.1.5.1.

  Following the TDP upgrade users are required to Configure TDP service HDFS again and also Configure TDP service Livy.

Known Issues

This section lists the issues known to exist in the product at the time of release.

CipherTrust Manager

CipherTrust Application Data Protection (CADP for C)

CipherTrust Cloud Key Manager

Issue	Synopsis
KY-92814	Problem: CCKM GUI: After applying a filter to a column, if you navigate away from the screen and return back, the filter may not persist. Workaround: Apply the filter again.
KY-87019	Problem: GWS GUI: When creating a new endpoint, the Identity Provider list displays only 10 identity providers. Workaround: Use the API to create a new endpoint using the required identity provider.
KY-86980	Problem: Salesforce GUI: When adding a new Salesforce key using DSM to configure the source key, the DSM Domain field on the Configure DSM Key screen may not display all the available DSM domains. Workaround: Use the API to add a new Salesforce key by uploading a DSM key created in a specific DSM domain.
KY-89969	Problem: Cloud key management APIs don't work behind a proxy for Google EKM, Google Workspace CSE, OCI HYOK, SAP, DSM, and external CipherTrust Manager. Workaround: Add the proxy URLs for your cloud to the proxy exception list and allow this URL in the firewall. Refer to URLs to Whitelist for Running CipherTrust Manager Behind Proxy.
KY-86632	Problem: Azure GUI: When adding a new Azure key, the Vault drop-down doesn't display all available vaults. Workaround: If a vault is not displayed on the GUI, use the API to create keys in the desired vault.
KY-84440	Problem: AWS GUI: Alias specified when linking an unlinked AWS HYOK key is not attached to the key. Workaround: Add the alias on the detail page of the key.
KY-82370	Problem: In a configuration with multiple Luna Network HSMs in high availability mode configured in the connection manager, when the HSM in use becomes unavailable, CCKM occasionally doesn't failover to the remaining HSMs.
KY-81514	Problem: SFDC: Refresh operations on CCKM don't remove certificates that are deleted from the SFDC console.
KY-80439	Problem: While editing a Cryptospace service account, the entry is removed from the list and added back to the Add Service field on the top. lf you keep clicking the Edit option on the next entry, it causes the previous entry to disappear.
KY-73919	Problem: Synchronize Salesforce certificate operations don't display error messages in audit logs.
KY-78298	Problem: SAP GUI: The Algorithm filter on the SAP Keys page doesn't show the RSA 8192 algorithm.
KY-77825	Problem: CCKM GUI: Account filtering doesn't work for the AWS keys and saved policies.
KY-76609	Problem: The custom policy statement doesn't update when rotating an AWS key on which the encrypt permissions are disabled (the "Disable Encrypt Permissions on Current Key" check box is selected).
KY-76521	Problem: CCKM: Intermediate keys in Luna HSM aren't cleaned up when the sync operation is performed.
KY-76510	Problem: CCKM: [Intermittent] After migrating source keys from CCKM Enterprise in multiple domains on the CM, AWS key rotation might return resource not found error.
KY-73679	Problem: Azure GUI: While importing an Azure certificate, if you select Yes for "Is Certificate File Password Protected?" and specify a password, later if you change to No without clearing the entered password, the password parameter is still picked up from the GUI. Workaround: Clear the specified password, and select the No option for "Is Certificate File Password Protected?".
KY-72770	Problem: OCI: The origin field of asymmetric HSM keys with External BYOK as Origin Type is set inconsistently for initial and subsequent versions. The origin of the initial version is correctly set to EXTERNAL. However, the origin of subsequent versions is incorrectly set to INTERNAL. This issue is at the Oracle end.
KY-72210	Problem: [AWS, Azure, and Luna HSM GUI]: When adding a new container or changing the connection of a container, the GUI lists only 10 connections. Workaround: Use the API or CLI to view all connections added to the CipherTrust Manager.
KY-72067	Problem: [GUI and API]: Salesforce mTLS connection doesn't work when the Salesforce connection to the CipherTrust Manager is configured using the Client Secret authentication. Workaround: Use the Certificate authentication from the CCKM UI or API or Client Credential (My Domain) authentication from the API when creating a Salesforce connection to the CipherTrust Manager.
KY-71243	Problem: [GUI]: Intermittent: If the key source has a large number of keys (say, in thousands), fetching all the keys may take a significant amount of time or the request may time out. Workaround: Use the API or CLI to fetch the keys.
KY-71194	Problem: [AWS GUI]: Intermittent: If the CipherTrust Manager has a large number of keys (in thousands), while adding an external key store, request to fetch the health check keys times out. The Health Check Key drop-down list does not display the existing keys. Workaround: Add the external key store using the API or CLI.
KY-67568	Problem: [AWS GUI] Incorrect policy behavior on switching the policy method from "Create New Policy" to "Select Saved Policy", and finally reverting to "Create New Policy". The values previously selected for the "Create New Policy" method remain selected. Either the values should be cleared or taken as input for the replica. A similar issue is observed with the Link Key operation.
KY-67474	Problem: [GCP GUI] Unable to add a key version using CipherTrust (External) from the details page of the key. Workaround: On the Google Keys page, overflow icon () corresponding to the desired key and click Add Version.
KY-66545	Problem: Luna HSM: On first time refreshing a Luna HSM partition after updating the Luna HSM connection from non-HA to HA enabled, the ha_enabled flag is set to false. Workaround: Refresh the partition again. It will update the ha_enabled flag to true.
KY-65575	CipherTrust Manager as an external key source shows incorrect status in the audit records. Also, the CipherTrust Manager does not show a detailed message if a CCKM User does not have the refresh and create key ACLs.
KY-65520	Problem: System might appear slow when the cloud event logs are more than 10 million. Workaround: Contact Thales Customer Support to clean the event logs.
KY-65165	Problem: SAP Data Custodian: A delete key job remains in the PENDING state for long time and fails intermittently. This issue is at the SAP end.
KY-64780	SAP Cloud: CLI does not list the disabled keys.
KY-64482	AWS KMS: Removing assume role and external ID values does not remove the values from the AWS KMS.
KY-59906	Problem: [AWS GUI] When updating the region of a KMS created with AssumeRole, the GUI displays all the available regions. They should be separated according to the assumed role.
KY-56952	Problem: GCP GUI: ACLs of Google Projects for cryptospaces and cryptospace endpoints can't be updated with the "CCKM Users" group. Workaround: Use the API to update the ACLs with the "CCKM Users" group.
KY-42082	SAP Data Custodian: SAP key activity report doesn't show any data. This issue is at the SAP end.
KY-39123	SAP Data Custodian: When a SAP group is added again, then performing any enable, disable, update, and add new version operation on a key in the group returns the "500 Internal Server Error". Workaround: Refresh the newly added group, add the key again, and retry operations.
KY-35220	When the CipherTrust Manager is upgraded, the Azure Keys page does not show any keys. "Error unescaping tags: invalid URL escape "%" 9 : NCERRInvalidParamValue" is returned. Workaround: Refresh all the key vaults.
KY-31186	If your proxy server does not support HTTP CONNECT, the CCKM Google cloud connection cannot use the CipherTrust Manager's proxy feature with a certificate. Workaround: Add an exception (cloudkms.googleapis.com) with no_proxy or use the proxy with username and password, and restart the services.
KY-31058	The manual add version/rotation process (using Clone Existing Key Material) of Google Cloud symmetric keys using migrated AWS DSM keys does not work.
KY-17213	When a CipherTrust Manager key is created using an auto rotation schedule on AWS cloud native key, its owner is set to "Global". Workaround: A CipherTrust Manager administrator can assign the ownership of the key to a desired user in the CCKM Users group.

CipherTrust Database Protection

CipherTrust Data Discovery and Classification

CipherTrust Secrets Management

CipherTrust Transparent Encryption

Application Data Protection

Batch Data Transformation (BDT)

ProtectApp

ProtectFile

CipherTrust Intelligent Protection