Release Notes

The release notes for Crypto Command Center 4.0 includes new features and enhancements, advisory notes, compatibility information, upgrade instructions, and resolved and known issues.

New Features and Enhancements

CCC 4.0 introduces a range of new features and enhancements, including:

• Faster deployment by installing CCC as a container.

• Automation of root of trust (ROT) creation process.

• Automation of high-availability (HA) configuration set up process.

• Capability to monitor the health, performance, and utilization metrics of Luna Network HSM devices using appliance software version 7.8.0.

• Support for Luna HSM Client version 10.5.0.

Advisory Notes

This section highlights important issues you should be aware of before deploying this release.

Server Monitoring

We recommend monitoring your CCC server configuration with a server monitoring system. CCC cannot notify the users of a CCC instance deactivation in the event of a server outage or disconnection.

Thales Luna Network HSM 7.1 Monitoring HSM CPU Usage

The Thales Luna Network HSM 7.1 device firmware incorrectly reports the value for HSM CPU usage. The firmware will always populate the HSM CPU usage monitoring histogram value as 99.9%. This is not an accurate evaluation of the HSM devices performance by CCC.

Support for 5.x Devices

CCC 4.0 does not support 5.x devices. If you are primarily managing 5.x devices, you may desire to defer this software upgrade at this time. If you are managing a combination of 5.x and 6.x devices, upgrading to CCC 4.0 will require upgrading your 5.x devices.

Thales Luna HSM 7.1 and Newer Device REST API

The REST API package comes pre-installed on Thales Luna Network HSM 7.1 and newer devices. As a user, you need to configure the REST API on the device. For better stability, use of the latest REST API versions is recommended, as listed below.

• 7.1.0 - 7.1.0-380

• 7.2.0 - 7.2.0-221

• 7.3.0 - 7.3.0-166

• 7.4.0 - 7.4.0-228

If STC is enabled, the webserver (REST API) of some Luna devices may need to be restarted.

ccc_client PED-Authenticated HSM Partition HA Group Service

If the user enters an incorrect challenge password when deploying a PED-authenticated HSM partition HA group service with ccc_client, the service will display as deployed but will not be operational. To deploy the service, relaunch ccc_client, select the service, and revoke access to that service. Then, deploy the service, as described in the CCC User Guide.

Database Security

CCC does not currently support full disk encryption on a PostgreSQL database. As a result, the integrity of the database server is the responsibility of the user. We recommend keeping your database server in an environment that is secured by software data networks and firewalls. Customers are responsible for ensuring compliance with their organization's security policies.

Freemium License

The CCC Freemium virtual image is not available with CCC 4.0. However, the Freemium license file is still supported with CCC 4.0 premium build. The Freemium license is available as part of the CCC software package.

The CCC Administrator user can now use the Update License button to replace the Freemium license file with the premium license when the product evaluation is completed.

Mixed High Availability Device Partition Groups

7.x devices do not support mixed high availability (HA) device partition groups. You cannot create an HA partition group consisting of both 6.x and 7.x devices. HA partition groups can only consist of 6.x or 7.x device partitions.

Java 1.8.0-144 JDK Memory Leak

The Java 1.8.0-144 JDK is not supported by CCC. The Java 1.8.0-144 JDK has a known security leak. It is recommended that you upgrade to the latest version of Java 1.8.0. For more information about the Java 1.8.0-144 JDK memory leak, review Java JDK issue 8164293.

Limitations of Luna Appliance Software 7.3.3 and 7.3.4

If you are using a Luna Network HSM device having Luna appliance software version 7.3.3 or 7.3.4, you will not be able to use certain features of CCC.

Non Availability of STC Support

CCC no longer provides support for STC with Luna Network HSM. The option to create a partition using STC is not available with Luna Network HSM 7 (Firmware 7.7.0 and above).

Compatibility Information

For information regarding the supported hardware, software, and managed devices, consult CCC User Guide.

Feature Matrix for CCC 4.0

This section outlines the minimum requirements to support major features and functionalities of CCC.

CCC Feature	Requires Monitoring License	Minimum SA Version	Minimum SA Firmware	Lunaclient
Service Provisioning		6.x	6.10.9	7.x
Security Officer Per Partition (PPSO)		6.x	6.10.9	7.x
Device & Service Reports		6.x		7.x
Import Services		6.x		7.x
Device Monitoring, Dashboard & Notifications	Yes	6.x	6.10.9	7.x
Device Monitoring (Full)	Yes	6.x	6.20.0	7.x
Service Monitoring	Yes	7.3	7.3.0	7.x
Device Logs	Yes	6.x		7.x
Key Material Visibility		6.x	6.10.9	7.1
External Directory Server over LDAP		NA	NA
Apply SW Package		7.3	NA	7.x
Update Firmware		7.3	NA	7.x
Migrate Service		6.2.2	6.24.3	7.2 and above

Upgrade Instructions

You can upgrade to CCC 4.0 from the following CCC versions:

• CCC 3.9

• CCC 3.8.1

• CCC 3.8

• CCC 3.7.2

• CCC 3.7.1

• CCC 3.7

You must perform some configuration after upgrade to ensure access for existing managed devices and application owners.

Backing up Existing CCC Version

Take a full backup of all CCC files before you begin. Enter the following commands to backup the existing Thales Crypto Command Center database:
su - postgres
pg_dump -f CCC_old_db_backup lunadirectordb

The database is backed up to the following file: /var/lib/pgsql/CCC_old_db_backup

Upgrading CCC from the Existing Version

1. Go to the CCC installation directory: cd /usr/safenet/ccc

2. Launch the uninstall.sh script and respond to the prompts to uninstall. Retain your firewall port and database tables.
   sh uninstall.sh
   Do you really want to uninstall Crypto Command Center Server? [n]
   Do you want to close the port used by CCC in the firewall? [y]
   Do you want to drop database tables? [n]
   Do you want to remove all files in the support catalogue? [n]

   If y is selected as the option, all the files in the support catalogue are deleted.

3. Install CCC 4.0, using the steps mentioned in the CCC User Guide.

4. Upload a license to CCC 4.0:

   a. The License Upload Modal appears on your screen.

   b. Click the Upload License button. The Upload License dialog displays.

   c. Click the Upload button and select the new license from your filesystem.

   d. Click the Continue or Update button.

5. Distribute CCC clients:

   a. From the Administration page, navigate to the Software Center to download an updated CCC client.

   b. Install this client on any application servers that access CCC.

Managing Device Upgrade from 5.x to 6.x

You may wish to upgrade your managed devices from version 5.x to 6.x or higher to obtain the benefits of 6.x features such as PPSO. If you choose to upgrade your managed devices to 6.x, there is some additional configuration necessary to integrate with CCC 4.0.

Upgrading to 6.x may result in the loss of configured service templates, users, HA groups, and partitions on the HSM.

To upgrade managed devices from 5.x to 6.x:

1. Inform any application users connecting to the devices that their services will be unavailable during the upgrade. You might like to perform the upgrade during a scheduled maintenance window.

2. Upgrade the Thales Luna Network HSM software as detailed in Thales Luna Network HSM documentation.

3. Set up REST API.

   a. As an appliance user with the Admin or Operator role, obtain and transfer the REST API secure package to the device via SCP/PSCP. Login to the HSM using Security Officer credentials, and install the package. See Thales Luna Network HSM REST API documentation for details.

   b. Set the REST API web service to use a network interface in the HSM. Valid values are all, eth0, eth1, or bond0: lunash:>webserver bind -netdevice

   c. Enable the web service: lunash:>webserver enable

   d. Generate a REST API service certificate and restart the service. We recommend an RSA certificate type: lunash:>webserver certificate generate -keytype rsa -restart

4. In CCC, navigate to the Devices list and select the recently upgraded device.

5. Click the Configuration tab and click Edit.

6. In the Appliance Version section, select 6.x. The LunaSH Admin Credentials section changes to REST API Credentials, and Host Key changes to Certificate.

7. Adjust the Host Address and Port Number as required. Save your changes.

8. Under the Certificate section, click Verify to view the device certificate.

9. Review the certificate, check the box indicating that you have reviewed and trust the certificate, and then click Accept.

10. Update the version of the Thales Luna HSM Client on any crypto application servers that access the device services. The device is now ready to process incoming cryptographic requests from application users.

Resolved and Known Issues

This section lists the resolved and known issues in the product at the time of release. Workarounds are provided where available. The following table defines the severity of the issues that are listed.

Priority	Classification	Definition
C	Critical	No reasonable workaround exists.
H	High	Reasonable workaround exists.
M	Medium	Medium level priority problems.
L	Low	Lowest level priority problems.

Known Issues

Issue	Severity	Synopsis
CCC-8303	M	Problem: If you login with a newly created user, and stay on the "change password" screen for five minutes with no activity, and then attempt a password change, you are redirected to a blank page. Workaround: This behavior indicates a timeout. You can reattempt login by clicking the back button or by re-entering the Thales Crypto Command Center address into the URL bar in the browser.
CCC-8319	M	Problem: If you add a 6.x device, and then use LunaSH to alter the admin password and the REST API certificate, you cannot update either the admin password or the REST API certificate on Thales Crypto Command Center. If you add a 5.x device, and then use LunaSH to alter the admin password and the SSH host key, you cannot update either the admin password or the SSH host key on Thales Crypto Command Center. Workaround: Update Thales Crypto Command Center immediately after updating the admin password, SSH host key, or REST API certificate on the appliance. Do not perform any other configuration until Thales Crypto Command Center is updated. If you accidentally change both the device password and the device identity (SSH host key or REST API certificate) without updating Thales Crypto Command Center, use LunaSH to change the admin password back to the previous value. In Thales Crypto Command Center, verify the SSH key or REST API certificate. Then return to the device and change the admin password to the new desired password. Update the admin password in Thales Crypto Command Center.
CCC-8819	M	Problem: If you create and deploy a service, change its organization, and then attempt to revoke access to the service, the full deregistration might not complete. For example, the revoke might not complete, the client entry might still be displayed in the service details tab, or the client might still be registered on the managed device partition(s). Workaround: If you attempted a revocation which did not complete, detach the service, re-import it, complete the normal application owner setup, and then revoke again. If you want to change a service's organization, first revoke client access, then change the organization, then deploy the service again. This ensures that future attempts to revoke access to the service will succeed.
CCC-9208	M	Problem: Monitoring data does not update automatically in the General and Capabilities tabs on the Device page. Monitoring information is retrieved and stored by the device, but is not generated automatically in the Thales Crypto Command Center graphic user interface on the General tab and the Capabilities tab. Workaround: Click Refresh in the Capabilities tab to generate up-to-date monitoring data.
CCC-10174	L	Problem: When sorting a Service Report, at times the Sort drop down menu loses its interface layer priority, appearing behind the entries in the Services List. Workaround: Minimize and expand the row where the issue is occurring.
CCC-12639	M	Problem: If the ccc_client.jar is run without trusting the server certificate, it throws an exception when Option 4 (exit) is directly selected after the run. Workaround: Always trust the server certificate when the ccc_client.jar is run.
CCC-13259	M	Problem: Sometimes when NFS server goes down in CCC High Availability setup, NFS clients becomes unresponsive. Workaround: Re-run enableNFSSharing.sh script on client side for NFS connection.
CCC-13260	M	Problem: Sometimes when a new NFS client is added to an existing High Availability CCC setup, permissions on shared folder of existing NFS clients change to some unknown permission. Workaround: Change the permission on shared folder /usr/safenet/ccc/packages and /usr/safenet/ccc/lunalogs to lunadirector.
CCC-13948	M	Problem: While migrating a large number of keys, the status bar displays a “null” message if object synchronization takes a long time. Workaround: You may encounter this error message in case a large number of keys are being migrated. However, the migration process will get completed despite this issue.
CCC-13980	M	Problem: The Migrate Service button appears enabled for a moment when the partition limit is reached. Workaround: Even if you are able to click this button, you will not be able to perform Migrate Service operation after the partition limit is reached.
CCC-14306	M	Problem: Unable to upgrade a device to firmware version 7.7.0 or 7.7.1. Workaround: Use LUSH to upgrade your device to firmware version 7.7.0 or 7.7.1. For details, refer to Luna HSM documentation.
CCC-14667	M	Problem: A log off button appears if an incorrect Crypto Officer password is provided under the Keys section after creating and initializing a service on a PED device. Workaround: This is a known issue. Please ignore the log off button and enter the correct password.
CCC-15079	M	Problem: If an FM-enabled device is used to create the root of trust during the CCC installation process, the following error is encountered: Unable to activate root of trust. Workaround: To overcome this issue: 1. Run the following four commands in succession, in case you are using Podman during the installation: podman exec -it ccc bash cd /usr/safenet/lunaclient/bin/ ./lunacm role login -n Crypto Officer Note: In case you are using Kubernetes during the installation, replace podman exec -it ccc bash with kubectl exec -it podname bash 2. Type proceed to continue when you witness the warning message: The HSM you are connecting to may contain Functionality Modules (FMs). 3. Activate ROT manually.

Supported Versions of CCC

The list of supported CCC versions can be found at Thales Customer Support Portal. As a user, you are advised to upgrade to the latest CCC version.

Contacting Thales Customer Support

If you encounter a problem while installing, registering, or operating this product, refer to the documentation before contacting support. If you cannot resolve the issue, contact your supplier or Thales Customer Support. Thales Customer Support operates 24 hours a day, 7 days a week. Your level of access to this service is governed by the support plan arrangements made between Thales and your organization. Please consult this support plan for further information about your entitlements, including the hours when telephone support is available to you.

Customer Support Portal

The customer support portal, at https://supportportal.thalesgroup.com, is where you can find solutions for most common problems. The Customer Support Portal is a comprehensive, fully searchable database of support resources, including software and firmware downloads, release notes listing known problems and workarounds, a knowledge base, FAQs, product documentation, technical notes, and more. You can also use the portal to create and manage support cases.

You require an account to access the Customer Support Portal. To create a new account, go to the portal and click on the REGISTER link.

Telephone Support

If you have an urgent problem, or cannot access the Customer Support Portal, you can contact Thales Customer Support by telephone at +1 410-931-7520. Additional local telephone support numbers are listed on the support portal.