KMIP Server - Release Notes
1.1.0 (2026-08-13)
Features:
- Server configuration is now stored on the HSM in data objects.
The config from the data object is merged into the local
kmipserver.propertiesat startup. The data object takes priority over the local file. - Support for multi-tenancy. Server can connect to multiple Partitions in a single HSM cluster.
Bug fixes:
- HSM-to-KMIP-database sync reliability improvements.
- Continue processing if a single object fails to sync, instead of aborting.
- Fix bugs of entries getting out-of-sync.
- Forward HSM error codes to the client (instead of returning a generic failure).
- Fixed masking of sensitive values (configured with
log.maskSensitive).
Components:
- KMIP SDK v2.5.1i
- Primus JCE provider v2.6.5
- log4j 2.25.4
- PostgreSQL JDBC driver 42.7.12
- Netty 4.2.16.Final
1.0.0 (2026-07-06)
Features:
- Keys stay protected by the Primus HSM at all times - no key material is stored in the server database. A key is retrieved from the HSM only when a client requests it.
- Additional key-management operations run directly against the HSM: splitting and rejoining keys, storing and retrieving secret data, and exporting keys.
- Deleting a key (Destroy or Obliterate) also removes it from the HSM, so a deletion is complete rather than leaving material behind.
- Changes to an object's attributes stay in sync with the HSM throughout the object's life, not only when it is first stored.
- KMIP user and object changes take effect immediately, without restarting the server.
- The server keeps its local database automatically in sync with the HSM.
- Server setup (users and objects) can be provisioned directly from the HSM, falling back to a local configuration file when none is present on the HSM.
- Audit and login records now include the KMIP username, giving a clearer audit trail.
- Audit logs can optionally be forwarded to an external syslog/SIEM system (turned off by default).
Security:
- TLS restricted to 1.3-only AEAD cipher suites; TLS 1.2 and supporting ciphers can be enabled through config.
- The non-standard HTTPS port (5697) is disabled by default.
- Container image can be run with dropped capabilities,
no-new-privileges, and a read-only root filesystem. - Images slimmed to a JRE-only runtime, based on Alpine Linux, and signed with Cosign for supply-chain verification.
Components:
- KMIP SDK v2.5.1d
- Primus JCE provider v2.6.3
- log4j 2.25.4
- PostgreSQL JDBC driver 42.7.11