KMIP Server - Release Notes

KMIP Server - v1.0.0

Issued: Jul 06, 2026

Feature:

• Keys stay protected by the Primus HSM at all times - no key material is stored in the server database. A key is retrieved from the HSM only when a client requests it.
• Additional key-management operations run directly against the HSM: splitting and rejoining keys, storing and retrieving secret data, and exporting keys.
• Deleting a key (Destroy or Obliterate) also removes it from the HSM, so a deletion is complete rather than leaving material behind.
• Changes to an object's attributes stay in sync with the HSM throughout the object's life, not only when it is first stored.
• KMIP user and object changes take effect immediately, without restarting the server.
• The server keeps its local database automatically in sync with the HSM.
• Server setup (users and objects) can be provisioned directly from the HSM, falling back to a local configuration file when none is present on the HSM.
• Audit and login records now include the KMIP username, giving a clearer audit trail.
• Audit logs can optionally be forwarded to an external syslog/SIEM system (turned off by default).

Security:

• TLS restricted to 1.3-only AEAD cipher suites; TLS 1.2 and supporting ciphers can be enabled through config.
• The non-standard HTTPS port (5697) is disabled by default.
• Container image can be run with dropped capabilities, no-new-privileges, and a read-only root filesystem.
• Images slimmed to a JRE-only runtime, based on Alpine Linux, and signed with Cosign for supply-chain verification.

Components:

• KMIP SDK v2.5.1, with a Netty-based server transport.
• Primus JCE provider v2.6.3 (primusX-jce-2.6.3.jar). See Primus JCE release notes for details.
• log4j 2.25.4.
• PostgreSQL JDBC driver 42.7.11.