Release Notes
The Crypto Command Center 4.3 Release Notes encompass a range of essential information, including new features, advisory notes, compatibility details, upgrade instructions, and resolved and known issues.
New features and enhancements
In this release, CCC expands deployment options with support for Microsoft Azure, alongside Podman, Kubernetes, and Helm. Additionally, CCC now supports Luna Appliance Software versions 7.8.4 and 7.8.5, enhancing integration and security. A new scheduler configuration for Luna Network HSM optimizes performance and monitoring. Users can also leverage advanced monitoring APIs for deeper insights into system performance. Other updates include updated password policies, flexible performance options for high availability groups, optional CA-signed certificate configuration, and the discontinuation of support for versions 5.x and 6.x.
Azure deployment now supported
CCC now supports deployment on Microsoft Azure, alongside existing options including Podman, Kubernetes, and Helm. This addition allows organizations leveraging Azure's cloud infrastructure to seamlessly integrate CCC into their environments, enhancing scalability, resilience, and global reach.
Support for Luna Appliance Software versions 7.8.4 and 7.8.5
CCC now supports Luna Appliance Software versions 7.8.4 and 7.8.5. This enhancement strengthens our integration with the Luna platform, ensuring improved operation and security for your cryptographic processes.
Introduction of scheduler configuration
We are introducing a new process for configuring the scheduler for your Luna Network HSM, essential for optimal performance and monitoring. This configuration allows you to manage properties like device monitoring intervals and log frequencies. To implement, create a scheduler-config.conf file and set up the required directories and permissions based on your deployment environment (Podman, Kubernetes, or Helm) to customize the scheduler for your operational needs.
Introduction of CCC monitoring APIs
With the latest release of CCC, we are pleased to introduce a suite of new monitoring APIs. These advanced APIs empower users to effectively track and manage system performance, offering deeper insights and greater control over your CCC environment. Leverage these tools to optimize your operations and enhance overall system efficiency.
Password policy update
We are introducing updated guidelines for password policies to help users maintain the security and integrity of their CCC environment. Familiarizing yourself with these rules is essential for effective protection.
Flexible performance options for high availability groups
HA groups can now include devices with different performance levels, specifically Standard, Enterprise, and Maximum. This flexibility allows you to optimize your HA setup to meet your specific operational requirements effectively.
Optional CA-Signed certificate configuration
An optional step has been added for configuring a CA-signed certificate for Luna Network HSM in the ccc_config.env file. Copy the CA-signed certificate to the ccc-certs folder, then enable it by setting HSM_IP1_CA_CERT_ENABLE=Y and specifying the certificate name. For High Availability setups, repeat for the second HSM by configuring HSM_IP2_CA_CERT_ENABLE=Y and specifying the second certificate.
Discontinuation of support for Luna Appliance Software versions 5.x and 6.x
CCC has discontinued support for Luna Appliance Software versions 5.x and 6.x. This decision is part of our commitment to providing the best possible experience by focusing on the latest, more secure, and feature-rich versions. We encourage users to upgrade to supported versions to ensure continued compatibility and access to the latest features and enhancements. For assistance with the upgrade process, please refer to our documentation or reach out to support.
Feature matrix for CCC 4.3
Below are the minimum system requirements necessary to support the essential features and functionalities of CCC:
| Feature | Minimum SA Version | Minimum SA Firmware |
|---|---|---|
| Device Monitoring (Full) | 7.3.0 | 7.3.0 |
| Apply SW Package | 7.3.0 | 7.3.0 |
| Update Firmware | 7.3.0 | 7.3.0 |
| Service Monitoring | 7.4.0 | 7.4.0 |
Advisory notes
This section outlines essential considerations for users to address before deploying the current release, aiming to facilitate informed decision-making and streamline implementation processes.
Potential performance impact with Rest API calls on partitions in CCC
Issue: A performance degradation issue has been identified when executing Rest API calls on partition resources in CCC while using firmware version 7.8.4 or later. Over time, these calls may significantly reduce the performance of cryptographic operations within CCC. This issue has not been observed with firmware versions 7.8.3 or earlier.
Suggested Action: Our engineering team is actively investigating the root cause. To prevent potential performance degradation, we recommend using firmware version 7.8.3 or earlier if you rely on Rest API calls on partition resources. If you choose to remain on firmware version 7.8.4, we suggest suspending or limiting the use of Rest API calls on partition resources in CCC until a resolution is available.
Supported Versions
We are committed to supporting the last three versions of CCC that have been released. Security patches and bug fixes are regularly applied to the latest versions within the 3.x and 4.x series. In the event of a critical security concern or bug, we may recommend upgrading to the latest version within your series to ensure optimal performance and security. While ongoing patches for older releases may not be provided, please rest assured that we strive to help you maximize the benefits of our software. If you encounter any questions or issues with a specific version, our team is readily available to assist you.
Security guidelines
Consult the security guidelines for CCC, which provide detailed recommendations and requirements to safeguard your CCC installation against various cyber threats, including Code Injection, Man-in-the-Middle (MITM), and Denial of Service (DoS) attacks, ensuring the protection of critical systems.
Server monitoring
We recommend monitoring your CCC server configuration with a server monitoring system. CCC cannot notify the users of a CCC instance deactivation in the event of a server outage or disconnection.
Thales Luna Network HSM 7.1 Monitoring HSM CPU Usage
The Thales Luna Network HSM 7.1 device firmware incorrectly reports the value for HSM CPU usage. The firmware will always populate the HSM CPU usage monitoring histogram value as 99.9%. This is not an accurate evaluation of the HSM devices performance by CCC.
ccc_client PED-Authenticated HSM Partition HA Group Service
If the user enters an incorrect challenge password when deploying a PED-authenticated HSM partition HA group service with ccc_client, the service will display as deployed but will not be operational. To deploy the service, relaunch ccc_client, select the service, and revoke access to that service. Then, deploy the service, as described in the CCC User Guide.
Database security
CCC does not currently support full disk encryption on a PostgreSQL database. As a result, the integrity of the database server is the responsibility of the user. We recommend keeping your database server in an environment that is secured by software data networks and firewalls. Customers are responsible for ensuring compliance with their organization's security policies.
Freemium license
The CCC Freemium virtual image is not available with CCC 4.3. However, the Freemium license file is still supported with CCC 4.3 premium build. The Freemium license is available as part of the CCC software package.
The CCC Administrator user can now use the Update License button to replace the Freemium license file with the premium license when the product evaluation is completed.
Limitations of Luna Appliance Software 7.3.3 and 7.3.4
If you are using a Luna Network HSM device having Luna appliance software version 7.3.3 or 7.3.4, you will not be able to use certain features of CCC.
Non availability of STC support
CCC no longer provides support for STC with Luna Network HSM. The option to create a partition using STC is not available with Luna Network HSM 7 (Firmware 7.7.0 and above).
Compatibility information
For information regarding the supported hardware, software, and managed devices, consult CCC User Guide.
Supported versions of CCC
The list of supported CCC versions can be found at Thales Customer Support Portal. As a user, you are advised to upgrade to the latest CCC version.
Upgrading CCC
To upgrade to the latest version of CCC, please refer to this link: Upgrading CCC
Resolved and known issues
This section lists the resolved and known issues in the product at the time of release. Workarounds are provided where available. The following table defines the severity of the issues that are listed.
| Priority | Classification | Definition |
|---|---|---|
| C | Critical | No reasonable workaround exists. |
| H | High | Reasonable workaround exists. |
| M | Medium | Medium level priority problems. |
| L | Low | Lowest level priority problems. |
Known issues
| Issue | Severity | Synopsis |
|---|---|---|
| CCC-8303 | M | Problem: If you login with a newly created user, and stay on the "change password" screen for five minutes with no activity, and then attempt a password change, you are redirected to a blank page. Workaround: This behavior indicates a timeout. You can reattempt login by clicking the back button or by re-entering the Thales Crypto Command Center address into the URL bar in the browser. |
| CCC-8819 | M | Problem: If you create and deploy a service, change its organization, and then attempt to revoke access to the service, the full deregistration might not complete. For example, the revoke might not complete, the client entry might still be displayed in the service details tab, or the client might still be registered on the managed device partition(s). Workaround: If you attempted a revocation which did not complete, detach the service, re-import it, complete the normal application owner setup, and then revoke again. If you want to change a service's organization, first revoke client access, then change the organization, then deploy the service again. This ensures that future attempts to revoke access to the service will succeed. |
| CCC-9208 | M | Problem: Monitoring data does not update automatically in the General and Capabilities tabs on the Device page. Monitoring information is retrieved and stored by the device, but is not generated automatically in the Thales Crypto Command Center graphic user interface on the General tab and the Capabilities tab. Workaround: Click Refresh in the Capabilities tab to generate up-to-date monitoring data. |
| CCC-10174 | L | Problem: When sorting a Service Report, at times the Sort drop down menu loses its interface layer priority, appearing behind the entries in the Services List. Workaround: Minimize and expand the row where the issue is occurring. |
| CCC-12639 | M | Problem: If the ccc_client.jar is run without trusting the server certificate, it throws an exception when Option 4 (exit) is directly selected after the run. Workaround: Always trust the server certificate when the ccc_client.jar is run. |
| CCC-13259 | M | Problem: Sometimes when NFS server goes down in CCC High Availability setup, NFS clients becomes unresponsive. Workaround: Re-run enableNFSSharing.sh script on client side for NFS connection. |
| CCC-13948 | M | Problem: While migrating a large number of keys, the status bar displays a “null” message if object synchronization takes a long time. Workaround: You may encounter this error message in case a large number of keys are being migrated. However, the migration process will get completed despite this issue. |
| CCC-13980 | M | Problem: The Migrate Service button appears enabled for a moment when the partition limit is reached. Workaround: Even if you are able to click this button, you will not be able to perform Migrate Service operation after the partition limit is reached. |
| CCC-14306 | M | Problem: Unable to upgrade a device to firmware version 7.7.0 or 7.7.1. Workaround: Use LUSH to upgrade your device to firmware version 7.7.0 or 7.7.1. For details, refer to Luna HSM documentation. |
| CCC-14667 | M | Problem: A log off button appears if an incorrect Crypto Officer password is provided under the Keys section after creating and initializing a service on a PED device. Workaround: This is a known issue. Please ignore the log off button and enter the correct password. |
| CCC-16025 | M | Problem: When migrating a V1 service from 7.8.x appliances to a new partition in CCC, the migration may fail, accompanied by an error message. The operation logs show an "Unsupported Cloning Protocol" message, indicating a protocol mismatch during the migration process. Workaround: There is currently no solution available for this issue. |
| RAPI-1853 | M | Problem: Upgrading the Luna Network HSM appliance from version 7.7.1 to 7.8.1 using CCC is currently not possible due to a bug in the REST API. Workaround: To update the appliance from version 7.7.1 to 7.8.1, users must manually connect to the LunaSH command-line interface and execute the upgrade procedure step by step. |
| RAPI-4205 | M | Problem: When adding a device in CCC, if the admin password contains a space character, the device cannot be added due to a bug in the REST API. Workaround: There is currently no solution available for this issue. |
Contacting Thales customer support
If you encounter a problem while installing, registering, or operating this product, refer to the documentation before contacting support. If you cannot resolve the issue, contact your supplier or Thales Customer Support. Thales Customer Support operates 24 hours a day, 7 days a week. Your level of access to this service is governed by the support plan arrangements made between Thales and your organization. Please consult this support plan for further information about your entitlements, including the hours when telephone support is available to you.
Customer support portal
The customer support portal, at https://supportportal.thalesgroup.com, is where you can find solutions for most common problems. The Customer Support Portal is a comprehensive, fully searchable database of support resources, including software and firmware downloads, release notes listing known problems and workarounds, a knowledge base, FAQs, product documentation, technical notes, and more. You can also use the portal to create and manage support cases.
You require an account to access the Customer Support Portal. To create a new account, go to the portal and click on the REGISTER link.
Telephone support
If you have an urgent problem, or cannot access the Customer Support Portal, you can contact Thales Customer Support by telephone at +1 410-931-7520. Additional local telephone support numbers are listed on the support portal.
