---
title: "Enroll a Compute Node (bare metal or VM) - SGX"
slug: "fortanix-ccm-enroll-a-compute-node-bare-metal-or-vm-sgx"
updated: 2026-07-22T14:09:36Z
published: 2026-07-22T14:09:36Z
canonical: "support.fortanix.com/fortanix-ccm-enroll-a-compute-node-bare-metal-or-vm-sgx"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enroll a Compute Node (bare metal or VM) - SGX

## 1.0 Introduction

This article describes how to enroll a compute node on a bare-metal or virtual machine (VM) with an Intel® Software Guard Extensions (SGX) platform in Fortanix Confidential Computing Manager (CCM).

## 2.0 Enroll A Compute Node (bare Metal) – SGX

### 

### 2.1 Ubuntu 24.04 Node Agent

Ensure to download the Ubuntu Node Agent Installer for SGX from [*here*](https://node-agent-installer.s3-us-west-1.amazonaws.com/onprem/ubuntu/latest/Node-Agent-Installer.tar.gz).

Perform the following steps to enroll the Ubuntu 24.04 compute node:

1. Run the following commands to extract the contents of the **Node-Agent-installer.tar.gz** package and open the folder:

```bash
tar -zxvf Node-Agent-Installer.tar.gz
cd em-agent-installer
```
2. Open the **INSTALLER_README.md** file containing the steps to enroll the compute node in Fortanix CCM.

![Text  Description automatically generated with medium confidence](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-enroll-compute-nodes-on-bare-metal---intel-tdx-v2.0-image-ktlj9vqg.png)

**Figure 1: Readme.txt**
3. Fortanix CCM supports all SGX-capable server nodes.
4. Ensure that applications running on the compute node are allowed to establish local connections to the Node Agent on port **9092**.

> [!WARNING]
> WARNING
> 
> As a security best practice, the Node Agent ports must not accept remote connections. Do not allow remote access to the Node Agent.
5. Copy the `installer.sh` file to the VM.
6. Run the following command to execute the **installer.sh** script:

```bash
sudo bash installer.sh <join-token> --attestation-type=<attestation-type>
```

Where,

> [!NOTE]
> NOTE
> 
> For Fortanix CCM on-premises SGX deployments, update the `EM_HOST_NAME` setting in the `/etc/em-agent/em-agent.conf` file from `ccm.fortanix.com` to `api.armor.onprem.fortanix.net`, and then restart the `em-agent` using the following command:
> 
> ```bash
> sudo systemctl restart em-agent
> ```
  - `&lt;join-token&gt;` is the token copied from Fortanix CCM. *For more information, refer to Section* [*3.0: Generate a Join Token*](/v1/docs/fortanix-ccm-enroll-a-compute-node-bare-metal-or-vm-sgx#30-generate-a-join-token)*.*
  - `&lt;attestation-type&gt;` is DCAP. It is strongly recommended to use the DCAP attestation while installing the node agent on Azure VM.

## 3.0 Generate a Join Token

Perform the following steps to generate a join token in Fortanix CCM:

1. Log in to Fortanix Armor Platform. *For more information,* [*Getting Started with Fortanix Armor*](/v1/docs/fortanix-armor-getting-started)*.*
2. Navigate to the Fortanix CCM user interface (UI). *For more information, refer to* [*Fortanix Armor Solutions*](/v1/docs/fortanix-armor-solutions)*.*
3. In the CCM UI left navigation panel, click **Infrastructure → COMPUTE NODES → Intel SGX**, and then click **ADD NODE**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3881).png)

**Figure 2: Add node**
4. In the **Enroll Compute Node** window, click **COPY** to copy the Join Token. This Join Token is used by the compute node to authenticate itself.

## 4.0 Validate the Enrolled Compute Node

After the compute node is successfully enrolled, it appears in the **COMPUTE NODES** overview table in Fortanix CCM.

## Related

- [Enroll a Compute Node Using AWS Nitro on Amazon Linux](/fortanix-ccm-enroll-a-compute-node-using-aws-nitro-on-amazon-linux.md)
- [Sequoia-PGP](/fortanix-dsm-clients-sequoia-pgp.md)
- [Fortanix DSM - Quickstart](/fortanix-data-security-manager-quickstart.md)