--- sourceDocument: australia Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/australia/delta-xanadu-australia Release : - australia ft:locale : - en-US ft:publication_title : - australia Combined Product Files ft:clusterId : - delta3ax bundleId : - delta3ax --- # Combined Key Management release notes for upgrades from Xanadu to Australia # Combined Key Management release notes for upgrades from Xanadu to Australia {#ariaid-title1} Release version: Australia Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Key Management Release Notes for Upgrades from Xanadu to Australia This consolidated release notes page guides ServiceNow customers through the key updates, changes, and important upgrade information for Key Management from the Xanadu release through to Australia. It highlights new features, deprecated elements, and upgrade considerations to help customers plan and execute their upgrades effectively while maintaining security and compliance. Show full answer Show less ## Important Upgrade Information * **Deprecation of 3DES Encryption:** Pre-Zurich instances used GlideEncrypter with 3DES encryption, which is deprecated per NIST guidelines. Australia release disables GlideEncrypter for new instances and replaces it with AES256-GCM encryption via the Key Management Framework (KMF). * **Upgrade Tasks:** Customers upgrading to Australia should review and complete specified pre- and post-upgrade tasks to ensure smooth transition and compliance. ## New Features Introduced * **Field Encryption Rebranding:** Column Level Encryption is rebranded as Field Encryption Starter (FES) and Column Level Encryption Enterprise as Field Encryption Enterprise (FEE). * **Access Observer:** Enables monitoring of data access by users and processes on the instance. * **Improved Migration:** Streamlined process for migrating data securely from Edge Encryption to Field Encryption without exposing data unencrypted. * **SHA512 Support:** GlideDigest now supports creating and verifying message digests using the SHA512 hash function for enhanced security. * **Offline Key Exchange:** Admins can share cryptographic module keys offline between on-premise instances to facilitate cloning and migration. * **JWT Signing and Verification:** JSON Web Token operations are integrated into the KMFCryptoOperation class for centralized cryptographic handling. * **Centralized Crypto Management Console:** New console to manage and track certificate lifecycles, scanning the instance for certificates and displaying details centrally. * **Clone and Restore Support:** Added capabilities for cloning and restoring on-premise instances, including migration between commercial and on-premise environments. * **CRL Validation Support:** Certificate Revocation List validation is now supported with automatic fallback to OCSP for certificate revocation checks. ## Key Changes * **Coral Theme:** Introduced as the default theme for portals, web, and mobile experiences, with an optional dark mode for enhanced user interface. * **GlideEncrypter Updates:** GlideEncrypter now defaults to AES256-GCM encryption. Legacy 3DES encryption can only be enabled by ServiceNow support if necessary. * **GlideEncrypter Enable/Disable:** Controlled via a system property on upgraded instances, disabled by default on new Zurich and later instances. * **Streamlined Cryptographic Module Creation:** Updated workflow simplifies and accelerates creating cryptographic modules. * **SecurityUtils API Enhancements:** Added methods to sanitize and escape inputs, improving protection against cross-site scripting attacks. ## Deprecations and Removals No Key Management features or functionality were removed or deprecated between Xanadu and Australia releases. ## Activation and Licensing Key Management activation requires the Platform Encryption subscription bundle, which includes Field Encryption Enterprise and Cloud Encryption. The Enterprise plugin is activated via the **com.glide.now.platform.encryption** plugin. ## Additional Considerations * There are no new browser, localization, accessibility, or additional requirements introduced for Key Management in the Australia release. * Customers should consult related knowledge base articles for detailed guidance on 3DES deprecation and GlideEncrypter usage. ## Benefits for ServiceNow Customers * Enhanced security compliance with updated encryption standards (AES256-GCM and SHA512). * Improved operational efficiency through centralized key and certificate management. * Simplified instance cloning and migration processes for on-premise environments. * Better visibility and control over data access with Access Observer. * Streamlined upgrade path with clear guidance on deprecated features and new capabilities. Consolidated page of all release notes for Key Management from Xanadu to Australia. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Key Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Australia. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Key Management to Australia Before you upgrade to Australia, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-keymanagement-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | Upgrade information : * In pre-Zurich releases, the GlideEncrypter API used the three-key Triple Data Encryption Standard (3DES) encryption standard, which [NIST 800-131A Rev 2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf) has recommended against using after 2023. The following changes are taking place in the Australia release in preparation for a full deprecation of GlideEncrypter/3DES in the future: * New Australia instances can't use GlideEncrypter. All base system scripts have been changed to use alternative encryption processes. * if you're upgrading your Australia instances, you can still GlideEncrypter, which has been updated to use AES256-GCM encryption via the Key Management Framework. * Learn more about 3DES deprecation in [KB1704481](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1704481). | [ ] ## New features Between your current release family and Australia, new features were introduced for Key Management. {#dfrn3-keymanagement-summary__entry__12} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Column Level Encryption is now Field Encryption](https://www.servicenow.com/docs/access?context=column-level-encryption-landing&family=yokohama&ft:locale=en-US) : Column Level Encryption has been rebranded to Field Encryption Starter (FES), while Column Level Encryption Enterprise is now Field Encryption Enterprise (FEE). [Access observer](https://www.servicenow.com/docs/access?context=access-observer&family=yokohama&ft:locale=en-US) : Use access observer to understand the people and processes that access data on your instance. [Improved migration process from Edge Encryption to Field Encryption](https://www.servicenow.com/docs/access?context=column-level-encryption-landing&family=yokohama&ft:locale=en-US) : Use the new process for migration from Edge Encryption to Field Encryption (formerly Column Level Encryption). This improved workflow ensures that your data migrates from Edge Encryption to Field encryption without spending time in an unencrypted state. | | Zurich | [Keep track of Field Encryption and Key Management changes](https://www.servicenow.com/docs/access?context=c_UnderstandingTheSysAuditTable&family=zurich&ft:locale=en-US) : By default, the changes to the records on these tables are now logged to the Sys Audits \[sys_audit\] table: * Encrypted Field Configurations \[sys_platform_encryption_configuration\] * Module Access Policies \[sys_kmf_crypto_caller_policy\] * Cryptographic Modules \[sys_kmf_crypto_module\] For details on accessing the Sys Audits \[sys_audit\] table, see [Review](https://www.servicenow.com/docs/access?context=c_UnderstandingTheSysAuditTable&family=zurich&ft:locale=en-US). | | Australia | [Added SHA512 support for message digests](https://www.servicenow.com/docs/access?context=c_GlideDigestScopedAPI&family=australia&ft:locale=en-US) : GlideDigest has been updated to allow creation and verification of message digests using the SHA512 cryptographic hash function. Offline key exchange to share module keys between instances : Admins can share module keys between instances offline to facilitate instance clones between on-premise instances using KMF. [Sign and verify JSON web tokens (JWT) through KMFCryptoOperation](https://www.servicenow.com/docs/access?context=KMFCryptoOperationBothAPI&family=australia&ft:locale=en-US) : The signing and verification processes for JWTs are now integrated as operation types in the existing KMFCryptoOperation class. Centralized Crypto Management console : Use the new Crypto Management Console to streamline and track the certificate management lifecycle. The new console scans your instance for certificates and displays their details in a central location, Clone and restore support for on-premise instances : Support for cloning and restoring on-premise instances. Support has also been added from migrating a commercial instance to on-premise instances, and vice-versa. Certificate Revocation List (CRL) validation support : ServiceNow now supports Certificate Revocation List (CRL) validation for certificate revocation checks as an alternative to Online Certificate Status Protocol (OCSP), with automatic fallback when OCSP is unavailable. | [ ] ## Changes Between your current release family and Australia, some changes were made to existing Key Management features. {#dfrn3-keymanagement-summary__entry__22} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Updates to GlideEncrypter functionality](https://www.servicenow.com/docs/access?context=glideencrypter-deprecation&family=zurich&ft:locale=en-US) : The GlideEncrypter API has been updated to use AES256-GCM encryption via the Key Management Framework. If needed, your instance can be changed to use legacy 3DES encryption, but this task can only be done by ServiceNow support. [Disable GlideEncrypter on your instance](https://www.servicenow.com/docs/access?context=check-3des&family=zurich&ft:locale=en-US) : GlideEncrypter can be enabled or turned off using the glide.security.glideencrypter.allow system property. This property is unavailable on new Zurich instances, but administrators with the security_admin role can edit this property in upgraded instances. When this system property is set to false, users see this error when attempting to run GlideEncrypter. Unsupported call to GlideEncrypter. Details: GlideEncrypter is deprecated and now returns null, please refer KB1320986 | | Australia | [Updated workflow for creating cryptographic modules](https://www.servicenow.com/docs/access?context=create-cryptographic-module&family=australia&ft:locale=en-US) : Use the streamlined workflow designed for faster, easier creation of cryptographic modules. [SecurityUtils Enhancements](https://www.servicenow.com/docs/access?context=GlideSecurityUtilsScopedAPI&family=australia&ft:locale=en-US) : The SecurityUtils API has been enhanced to help prevent cross-site scripting attacks, including methods to sanitize and escape input. | [ ] ## Removed Between your current release family and Australia, some Key Management features or functionality were removed. {#dfrn3-keymanagement-summary__entry__32} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Deprecations Between your current release family and Australia, some Key Management features or functionality were deprecated. {#dfrn3-keymanagement-summary__entry__42} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Activation information Review information on how to activate Key Management. {#dfrn3-keymanagement-summary__entry__52} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | Activation information : The Platform Encryption subscription bundle is a group commercial entitlement that includes Field Encryption Enterprise and Cloud Encryption. Field Encryption Enterprise is the unlimited license of Field Encryption. The Enterprise plugin is available with the activation of the com.glide.now.platform.encryption plugin. For details, see [Encryption and Key Management subscription bundle](https://www.servicenow.com/docs/access?context=encryption-sku&family=australia&ft:locale=en-US). | [ ] ## Additional requirements If any additional requirements were introduced or changed for Key Management we have noted them here. {#dfrn3-keymanagement-summary__entry__62} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Key Management we have noted them here. {#dfrn3-keymanagement-summary__entry__72} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Key Management, such as specific requirements or compliance levels. {#dfrn3-keymanagement-summary__entry__82} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Key Management we have noted them here. {#dfrn3-keymanagement-summary__entry__92} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Key Management we have noted them here. {#dfrn3-keymanagement-summary__entry__102} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | * GlideDigest has been updated to allow creation and verification of message digests using the SHA512 cryptographic hash function * Admins can share module keys between instances offline to facilitate instance clones between on-premise instances using KMF. * The signing and verification processes for JWTs are now integrated as operation types in the existing KMFCryptoOperation class. See [Key Management Framework](https://www.servicenow.com/docs/access?context=encryption&family=australia&ft:locale=en-US) for more information. | [ ]