Release Notes

NSE-48648

The Web Services PKCS #11 library has a dependency on a third party called cpprestsdk which has an internal threadpool limit of 40. There is a potential issue in the PKCS #11 library which means that if an application is running more than 40 threads and encounters a large number of persistent errors from the Web Services Option Pack server then the threads can become blocked and an application restart would be necessary. This issue can be mitigated by using fewer threads, and by making use of the config file options MAXRETRIES and RETRYDELAY. Increasing the value of RETRYDELAY introduces a delay between retries of failed Web Services Option Pack requests.

The Web Services PKCS #11 library has replaced the dependency on cpprestsdk with libcurl. This fixes an issue that could cause an application to hang when running more that 40 threads and encountering persistent errors from the Web Services Option Pack server.

NSE-53106

String fields such as CKA_LABEL and CKA_APPLICATION should not contain any HTML character for example <, > or & as this can result in those values becoming corrupted when they are retrieved later.

HTML characters saved in string attributes are not corrupted when retrieved.

NSE-54022

The Web Services Option Pack server can temporarily become unresponsive if a large number of time intensive requests are sent concurrently. This will cease when the requests are completed.

New concurrent request limit configuration options have been added to allow Web Services Option Pack to be tuned to the hardware resources.

NSE-56651

An incorrect HTTP response status code of 422 is returned (instead of 400) when a key generation request is rejected because the key ident parameter contains non-alphanumeric characters.

When a key generation request is rejected because the ident parameter contains non-alphanumeric characters a correct HTTP response status code of 400 is now returned.

NSE-56871

The offset filter option is not supported by the protectiondomains endpoint. If needed, offset can be used with the groups endpoint in order to identify and retrieve the desired protection domain.

The offset filter option is now supported by the protectiondomains endpoint.

NSE-56921

Web Services Option Pack will not self recover if the connection to the MongoDB server is interrupted enough for the periodic health check to fail. If this happens, the Web Services Option Pack service will need to be restarted before the system can resume operation.

Web Services Option Pack will now recover if the connection to the MongoDB server returns after an unsuccessful health check without the need for a restart.

NSE-57190

When a CRL is processed, invalid certificates can be ignored silently. However, a successfully revoked certificate is reported correctly in the logs.

When a CRL is added to the crl_directory that has an invalid signature, an appropriate error is logged. Issues with CRL files are now classified as ERROR level instead of WARNING level in the logs.

NSE-57210

N/A

A documentation issue has been resolved regarding the use of filters when sending a GET request.

NSE-57708

N/A

Updated the help text for dbmt migrate so that the required parameters for the key option are clearer.

NSE-58786

N/A

Fixed an issue where sending an activate protection domain request with a blank passphrase would return an incorrect error code.

NSE-59253

N/A

Corrected discrepencies in some examples of the API specification file.

NSE-60609

N/A

Fixed an issue where the softcardtool failed to correctly parse configuration files with trailing spaces.

NSE-60703

N/A

Fixed an issue which would allow partial migration of PKCS #11 objects.

NSE-60805

N/A

Fixed an issue which prevented DBMT support for Security World v13.4+.

NSE-61433

N/A

CKA_PRIVATE is no longer a required attribute when creating objects or generating keys. When omitted a default value is now used.

NSE-61703

N/A

Fixed a segmentation fault produced when the template for a PKCS #11 object creation contained a string attribute (eg; CKA_LABEL) which had NULL pointer as a value.

NSE-63134

N/A

Fixed an issue where the database could not be easily updated after a change in Security World files. The DBMT db-init function can now be used to update these files in the database.

NSE-64288

N/A

Keys with unsupported appnames can no longer be migrated into the database using dbmt migrate. Instead of being migrated, these keys will be skipped.

NSE-56623

Key records from releases prior to Web Services Option Pack version 3.2 may be incompatible with newer releases of Web Services Option Pack and be limited in future functionality. Customers wishing to upgrade from version 3.0 or 3.1 should contact Entrust Support for more information.

NSE-62643

It is not possible to use RSA when performing an integration with the nShield Web Services Key Storage Provider and Microsoft IIS. Attempting to do so will result in the provider returning the following error: pszAlgId must not be NULL in BCRYPT_PKCS1_PADDING_INFO.

NSE-62766

Using the nShield Web Services Key Storage Provider to list the keys in a protection domain can result in ServiceUnavailable being returned from the corecrypto service if the number of keys in the protection domain exceeds 10,000.

NSE-62811

If the system that is hosting the Web Services Option Pack is restarted, the service can fail to automatically restart if the MongoDB server is not reachable in time. In this case the service can be started manually when the database is available.

NSE-63105

If the HSM is put into a non-operational mode, when it is returned to Operational mode the corecrypto service must be restarted before normal service can resume.

NSE-63763

Descriptions of individual nShield Web Services Key Storage Provider event log entries, when viewed through Event Viewer, may contain text indicating that the description for a particular Event ID cannot be found. This message is benign as the logs generated by the provider are contained within the description.

To address this issue, copy nflog-msgs.dll from %ProgramFiles%\nCipher\WebServices\CNG\lib\nflog-msgs.dll (assumes default install location) to %ProgramFiles%\nCipher\nfast\bin\nflog-msgs.dll if it does not already exist.

NSE-64343

There is an issue when using dbmt db-init that any OCS must have passphrase recovery disabled (e.g. in createocs the -no-pp-recovery option needs to be set).