HSM Client 10.4.1
HSM Client 10.4.1 was released in December 2021. It includes bug fixes and security updates.
>Download HSM Client 10.4.1 for Windows
>Download HSM Client 10.4.1 for Linux
New Features and Enhancements
HSM Client 10.4.1 includes the following new features and enhancements:
Clone Objects From Multifactor Quorum-Authenticated Luna HSMs to Luna Cloud HSM
HSM Client 10.4.1 allows you to clone objects between multifactor quorum-authenticated Luna HSM partitions and Luna Cloud HSM. You can now use Luna Cloud HSM services to back up any Luna 7 HSM securely in the cloud.
See Initializing a Luna Cloud HSM Service.
Supported Operating Systems
You can install HSM Client 10.4.1 on the following operating systems:
| Operating System | Version | Secure Boot Supported |
|---|---|---|
| Windows | 10 | Yes |
| Windows Server Standard | 2022 | Yes |
| 2019 | Yes | |
| 2016 | Yes | |
| Windows Server Core | 2022 | Yes |
| 2019 | Yes | |
| 2016 | Yes | |
| Redhat-based Linux (including variants like CentOS) | 8.0, 8.1, 8.2, 8.3, 8.4 (†) | No |
| 7 | No | |
| Ubuntu * | 21.04 | No |
| 20.04 | No | |
| 18.04 | No | |
| Debian | 11 | No |
| 10 | No | |
| 9 | No | |
| 8 | No |
* The Linux installer for HSM Client software is compiled as .rpm packages. To install on a Debian-based distribution, such as Ubuntu, alien is used to convert the packages. We used build-essential:
apt-get install build-essential alien
If you are using a Docker container or another such microservice to install the Luna Minimal Client on Ubuntu, and your initial client installation was on another supported Linux distribution as listed above, you do not require alien. Refer to the product documentation for instructions. You might need to account for your particular system and any pre-existing dependencies for your other applications.
† RHEL and CentOS 8.0-8.4 with their original kernels. See also Red Hat Enterprise Linux 8 in FIPS Mode Requires Minimal HSM Client.
Supported Cryptographic APIs
Applications can perform cryptographic operations using the following APIs:
>PKCS#11 2.20
>OpenSSL
>Microsoft CAPI
>Microsoft CNG
>Supported Java versions:
•Open JDK 7 up to Open JDK 17
•Oracle Java 7 up to JDK 17
•IBM Java 7, 8 and 11
Advisory Notes
This section highlights important issues you should be aware of before deploying HSM Client 10.4.1.
Backup/USB/PCIe Drivers Not Installed on Windows 10 or Windows Server 2022 Unless Device is Connected
Due to changes in Windows 10 and Server 2022, device drivers are not installed unless the USB or PCIe device is connected to the client workstation. If you plan to use a Luna Backup HSM 7, Luna Backup HSM G5, Luna USB HSM 7, or Luna PCIe HSM with these operating systems, use one of the following workarounds:
>Connect the Luna device to the workstation (or install the Luna PCIe HSM card) before installing the HSM Client software
>After installing the HSM Client software:
a.Connect the Luna device(s) to the workstation (or install the Luna PCIe HSM card)
b.Run LunaHSMClient.exe.
c.Select the devices you want to install drivers for.
d.Click Modify.
Red Hat Enterprise Linux 8 in FIPS Mode Requires Minimal HSM Client
RHEL 8.x introduced system-wide cryptographic modes. The full HSM Client installer is supported only when RHEL 8.x is in DEFAULT mode. If your RHEL 8.x OS is in FIPS mode, use the minimal HSM Client.
Support for Windows Server 2012 R2 is Ended
HSM Client 10.3.0 is the last version that will support Windows Server 2012 R2.
Red Hat Enterprise Linux / CentOS 6 Support is Ended
HSM Client 10.2.0 is the last version that will support RHEL 6 and related operating systems. If you plan to install future client updates, consider updating your clients to RHEL 7 or 8.
Support for 32-bit OS Platforms is Ended
Starting with HSM Client 10.2.0, 32-bit libraries are no longer provided. If you have a 32-bit application or integration, remain with a previous client release or migrate to 64-bit platform.
Older JAVA Versions Require Patch/Update
The .jar files included with HSM Client 10.x have been updated with a new certificate, signed by the Oracle JCE root certificate. This certificate validation requires a minimum Oracle JDK/JRE version.
>If your application relies on Oracle Java 7 or 8, you must update to the advanced version provided by Oracle. You require (at minimum) version 7u131 or 8u121. Please refer to Oracle's website for more information: https://www.oracle.com/technetwork/java/java-se-support-roadmap.html
>If your application relies on IBM Java 7 or 8, you must install a patch from IBM before updating to HSM Client 10.x (see APAR IJ25459 for details).
CKR_MECHANISM_INVALID Messages in Mixed Luna Cloud HSM Implementations
When using a Luna Cloud HSM service with HSM Client, you might encounter errors like "CKR_MECHANISM_INVALID" or "Error NCryptFinalizeKey" during some operations in Hybrid HA and FIPS mode (3DES Issue). This can occur if firmware versions differ between a Luna HSM partition and a Luna Cloud HSM service in an HA group when you invoke a mechanism that is supported on one but not the other. Similarly, if one member is in FIPS mode, while the other is not, a mechanism might be requested that is allowed for one member, but not the other. For example, the ms2luna tool can fail when 3DES operations are invoked.
