See below for the known limitations in Compliance Manager 10.6.1.


Incorrect compliance result for SLH-DSA when policy is configured for DSA

The compliance test incorrectly reports a Pass instead of a Fail when the verify-cryptographic-algorithm compliance policy is configured to allow only RSA, DSA, AES, ECDSA, and EdDSA algorithms, but the evaluated Cryptographic Asset has its cryptographic_algorithm set to SLH-DSA-SHA2-192f.

Tenant Administrator login fails on re-deployed CSP Compliance Manager 10.6.1 after backup restore

After restoring a backup to a newly deployed CSP Compliance Manager 10.6.1 with the same and a different IP address, the tenant administrator can no longer access the Compliance Manager Appliance Management webGUI and receives an OIDC authentication error. The following workaround applies to both of the scenarios described below:

Scenario 1: 10.6.1 Default tenant is configured for Local Authentication, AD authentication, or OIDC authentication

  1. Take a backup of the Compliance Manager appliance.
  2. Power off the Compliance Manager virtual machine (VM).
  3. Deploy a new Compliance Manager VM using the same hostname and IP address.
  4. Restore the Compliance Manager appliance from the backup.
  5. Log in to Compliance Manager using the default tenant administrator credentials. The login succeeds.
  6. Log in to the default tenant using the default tenant administrator credentials. The login succeeds.
  7. Click Switch to Appliance Management. The login fails.

Scenario 2: 10.6.1 Default tenant is configured for OIDC authentication 

  1. Take a backup of the Compliance Manager appliance.
  2. Power off the Compliance Manager VM.
  3. Deploy a new Compliance Manager VM using a different hostname and IP address.
  4. Restore the Compliance Manager appliance from the backup.
  5. Log in to Compliance Manager using the default tenant administrator credentials. The login succeeds.
  6. Log in to the default tenant using the default tenant administrator credentials. The login succeeds.
  7. Click Switch to Appliance Management. The login fails.

Workaround: 

  1. Log in to the CSP Compliance Manager webGUI as the secroot user.
  2. Enable the support user (htsupport). For more information, see: Manage Full Support Access.
  3. Log in to the Compliance Manager VM console as htsupport.
  4. Run the following command to update the CA certificate that the Compliance Manager appliance trusts for OIDC authentication:
    sudo k3sadmin.py appliance --set-oidc-ca

    A message similar to the following displays:
    No Appliance action specified.
     
  5. Exit the Compliance Manager VM console.

X-y-not After and X-y-not Before fields display as invalid for KMIP certificate objects

The X-y-not After and the X-y-not Before fields display Invalid Date for KMIP certificate objects.

Rotation Date not displayed for Secrets Data Source objects

The Rotation Date field does not display a value for Secrets Data Source objects in the CSP Compliance Manager webGUI.

User menu displays tenant name instead of user name

The CSP Compliance Manager User menu displays the tenant name instead of the user's full name.

Default tenant users lose appliance administrator access after upgrade to 10.6.1

Default tenant users who previously had appliance administrator privileges may lose access after upgrading to release 10.6.1. As a workaround, log in to the default tenant as an administrator and disable, then re-enable, appliance access for affected users.

Asset listing APIs are case-sensitive

Cryptographic Assets and AI Assets listing APIs are not case-insensitive.

Approved SAN verification flags valid entries

Compliance check for operation verify-approved-san incorrectly flags valid SAN entries when a custom approved value is configured.

Automatic login does not work for the Vault tenant

Automatic login does not work for the Vault tenant. Users must click Login to continue. For the CSP Compliance Manager tenant, the application redirects users to the IDaaS login page and the user is authenticated automatically.

Compliance score rounding can hide small variations

Compliance scores are rounded to the nearest whole number for clarity and readability. As a result, small compliance variations may not appear in the displayed score.

KeySafe5 behind a load balancer requires accessible node IP addresses

If you want to use KeySafe5 behind a load balancer, the CSP Compliance Manager node IP addresses must be accessible from the KeySafe5 client.

KeySafe5 is not supported for cloud installations

KeySafe5 is not supported for Cloud installations, such as AWS, Azure, or GCP.

Powering off the non-database master node returns a KeySafe 5 UI error

In a 2-node cluster setup, powering off the non-database master node returns a 500 error in the KeySafe 5 UI.