--- title: "FAQs - Install/Upgrade/Administration" slug: "fortanix-faqs-install-upgrade-administration" updated: 2026-07-17T10:16:46Z published: 2026-07-17T10:16:46Z canonical: "support.fortanix.com/fortanix-faqs-install-upgrade-administration" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # FAQs - Install/Upgrade/Administration --- ### FAQ #### How to size storage for my backups? For more information, refer to [*Backup Sizing*](/v1/docs/introduction-to-fortanix-dsm-backup-and-restore#40-backup-sizing) in Introduction to Fortanix DSM Backup and Restore. #### How to do a factory reset? What does it do? To reset the appliance to the factory default, you can use `sdkms_cleanup.sh` script available under `/opt/fortanix/sdkms/bin/`. #### What is the default PKCS#11 log rotation policy? Fortanix DSM cluster logs used for system debugging are now rotated by default to prevent disk space issues. They are rotated at 1G and maintains two previous/rotated logs #### How to interpret the appliance uptime that is displayed? The uptime shown in the Intelligent Platform Management Interface (IPMI) WebUI is the total uptime of the server since it was built. #### What are the different FIPS level Fortanix DSM supports? Fortanix DSM supports FIPS Level 3. #### How to capture support data that will help in easy debugging? From Fortanix DSM 3.23 release the following script can be used to debug faster. #### How to capture support data that will help in easy debugging? From Fortanix DSM 3.23 release the following script can be used to debug faster. ```bash /opt/fortanix/sdkms/bin/support_dump.sh --node-info sudo /opt/fortanix/sdkms/bin/support_dump.sh --cluster-info ``` This will generate a support dump under `/data` folder. #### Does the Disaster Recovery (DR) node need to be joined to the cluster during an upgrade? No, adding the DR node to the cluster during the upgrade activity is not necessary. Fortanix recommends upgrading the DR node separately, followed by the main cluster upgrade. #### Can the DR node be upgraded independently from the cluster? A Cluster Master Key (CMK) rotation on the cluster would require the DR node to be wiped and joined again. #### How do I find the Fortanix DSM cluster URL? You can use the following methods to get the Fortanix DSM cluster URL: **Method 1**: Cluster URL can be found by running the below curl commands on the CLI: - Using curl command: ```bash curl -vk https://sdkms-pod-ip:4444/sys/v1/health ``` - Using openssl command: ```bash openssl s_client -connect nodeip:443 ``` **Method 2**: Cluster URL can be found in the Fortanix DSM browser window. Example: [https://amer.smartkey.io](https://amer.smartkey.io) where “amer.smartkey.io” is the cluster URL #### How to power off the Fortanix DSM node? You can use one of the following methods to power off each Fortanix DSM node: - Using the IPMI web console: - Log in to the IPMI web console and go to the **Power Control** tab to power off the node. - Using the DSM CLI commands. #### How to restart an sdkms-ui service on a hardware cluster? The sdkms-ui is an integrated service in the Fortanix DSM cluster. You must do a rolling restart of the sdkms-ui service from the DSM command line interface (CLI), or you can run the following command one by one on each node: ```bash kubectl delete pod sdkms-ui-xxxx ``` Where, `xxxx` is the name of the sdkms-ui pod on each node. #### Why is the DSM version visible but the "sdkms-cluster" commands are not working? The package installation may not be successful. Review the package installation logs. Alternatively, run the cleanup script and try installing the package again: ```bash /opt/fortanix/sdkms/bin/sdkms_cleanup.sh ``` If you see the following error, the cleanup script is not found: ```bash -bash: /opt/fortanix/sdkms/bin/sdkms_cleanup.sh: No such file or directory. ``` If the cleanup script is not found, contact Fortanix Support at [support@fortanix.com](mailto:support@fortanix.com). #### After cluster creation, why is the SDKMS pod in 0/1 running status and the proxy pod in CrashLoopBackOff? The Fortanix DSM cluster certificates must be configured and installed for the pods to come up and run successfully. Once the certificates are installed, you can access the Fortanix DSM UI and services. *For more information, refer to* [*Install Certificates*](https://support.fortanix.com/docs/fortanix-data-security-manager-installation-guide-on-prem#46-install-certificates) *in the Installation Guide - On-Premises.* #### Why is the Fortanix DSM UI not accessible in the browser? There can be multiple reasons for this. Perform the following checks: - Check the DSM pod status by running the following command. All pods should be up and in running status: ```bash sudo -E kubectl get pods -owide ``` - Check cluster health by running the following script: ```bash /opt/fortanix/sdkms/dsm_healthchecks/run_health_checks.sh ``` - Verify that DNS entries point to the correct DSM URL with IP addresses. Try accessing the URL over ports 4445 and 443 to confirm the ports are open and reachable. If the issue persists, open a support ticket at [support.fortanix.com](http://support.fortanix.com). #### On which port must the Fortanix DSM cluster health checks be performed from the load balancer? The load balancer must be configured to use port **4445/TCP** to perform Fortanix DSM cluster health checks. #### Can Fortanix DSM be downgraded to a previous version? Downgrade from any prior Fortanix DSM version is not supported due to kernel upgrades. *For more information, refer to the* [*Release Notes*](https://fortanix.zendesk.com/hc/en-us/categories/360006153871-Downloads)*.* #### Can Fortanix DSM be deployed on cloud? Fortanix DSM can be deployed on AWS, GCP, Azure, VMware, and Nutanix AHV. *For more information, refer to* [*Fortanix DSM Cloud Deployment*](https://support.fortanix.com/docs/fortanix-data-security-manager-cloud-publicprivate)*.* #### How to check current DSM cluster configuration? Run the following commands to get the cluster configuration: ```bash sdkms-cluster get config --user sdkms-cluster get config --system ``` #### Can a cluster be created with one node or is it mandatory to have three nodes? A Fortanix DSM cluster can be created on a single node; however, this includes the following risks: - Single point of failure - Service disruption during upgrade - Hardware failure - Impact on availability due to any kind of failure Fortanix recommends having at least **3 nodes** for successful operation of Fortanix DSM. #### Why does a permission error occur while installing the DSM package? This occurs when the umask value is not set correctly. The current umask value is **0027**, which needs to be set to **0022**. Perform the following steps: 1. Make the package executable: ```bash chmod +x ``` 2. Set the correct umask value: ```bash umask 0022 ``` 3. Run the installation package again. #### Is it required to create a cluster on the other nodes while joining? The DSM package must be installed on all nodes, but the cluster is deployed on only one node. The remaining nodes can be added using the join command. *For more information, refer to* [*Add Node to an Existing Fortanix DSM Cluster*](https://support.fortanix.com/docs/fortanix-data-security-manager-installation-guide-on-prem#60-add-node-to-an-existing-fortanix-dsm-cluster)*.* #### Why is the kube-apiserver unreachable while executing kubectl commands? The path to the Kubernetes config file has not been set as an environment variable. If you see the following error: ```bash $ kubectl get pods -owide The connection to the server localhost:8080 was refused - did you specify the right host or port? ``` Run the following command: ```bash export KUBECONFIG=/etc/kubernetes/admin.conf ``` After running this command, kubectl commands should execute as expected. If the issue still persists, open a support ticket at [support.fortanix.com](http://support.fortanix.com). #### Why the certificates are not getting installed when SDKMS pod is in CrashLoopBackOff? After cluster creation, wait until the SDKMS pod comes up into **0/1 running** state before proceeding with certificate installation. If the pod remains in a crashed state, check the pod logs for exit errors: ```bash kubectl logs ``` #### Why is the NTP check showing a warning while running the cluster health check? Ensure that the NTP configuration file at `/etc/ntpsec/ntp.conf` has the correct NTP server entry and that the node is in sync with the NTP server. Check the NTP status by running: ```bash ntpq -p ``` The sync is indicated by the prefix `*`. Check connectivity with the NTP server using: ```bash nc -zvu 123 ``` #### Why are disk space warnings appearing in cluster health checks? This warning is generated when `/var` usage exceeds 70%. ```bash DISK_CHECK_[/var]: WARN : x.x.x.x. : /var usage: 85% ``` Run the following command to check whether old DSM images are present on the affected node: ```bash crictl images ls crictl rmi --prune ``` If old images are found, open a support ticket at [support.fortanix.com](http://support.fortanix.com) for assistance in removing them. #### The existing Kubernetes token has expired. How to create a new token to join a new node? The token is valid for only 24 hours. Create a new token using the following command: ```bash kubeadm token create ``` #### The cluster node is down and cannot be accessed. How to bring the node up? Check the connectivity to the affected node and verify the kubelet service status: ```bash nc -zv 10250 systemctl status kubelet.service ``` Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. ## Related - [CMK Rotation - Fortanix DSM Version Below 5.6](/cmk-rotation-fortanix-dsm-version-below-5-6.md) - [FIPS Replication](/fortanix-data-security-manager-fips-replication.md) - [PKCS#11 Library](/fortanix-dsm-clients-pkcs11-library.md) - [Installation on VMware](/fortanix-data-security-manager-installation-on-vmware.md)