--- title: "Fortanix DSM for MongoDB Encryption at Rest - Linux" slug: "fortanix-dsm-for-mongodb-encryption-at-rest-linux" updated: 2026-07-08T17:32:20Z published: 2026-07-08T17:32:20Z canonical: "support.fortanix.com/fortanix-dsm-for-mongodb-encryption-at-rest-linux" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM for MongoDB Encryption at Rest - Linux ## 1.0 Introduction **MongoDB Enterprise** version supports the encryption of data at rest. The data encryption process involves generating a master key which is the root of the key hierarchy of various keys used by MongoDB. Cryptographically secure generation and secure management of this master key are required for the true security of data at rest encrypted by MongoDB. [Fortanix Data Security Manager](https://fortanix.com/products/sdkms/) with its KMIP support provides a secure and flexible solution for this. MongoDB supports KMIP and it authenticates to a KMIP enabled key management server using a client certificate. Fortanix-Data-Security-Manager (DSM) supports clients/apps to authenticate using API Key, app ID, and certificate or just certificate. In this article, we will describe how to set up an app in Fortanix DSM for MongoDB to integrate with Fortanix DSM. *MongoDB Enterprise do not support AES256-GCM on Windows. For more information, refer to the* [*MongoDB official documentation*](https://www.mongodb.com/docs/upcoming/core/security-encryption-at-rest/)*.* ## 2.0 Product Tested Version The following product versions were tested: - MongoDB Enterprise version 7.0.6. - Fortanix DSM version 4.23. ## 3.0 Configure Fortanix DSM A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections: ### 3.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 3.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(17).png) **Figure 1: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ### 3.3 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(57).png) **Figure 2: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a title for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create the new group. *For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.* > [!NOTE] > TIP > > It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.* ### 3.4 Creating an Application Perform the following steps to create an application (app) in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(55).png) **Figure 3: Add application** 2. On the **Adding new app** page: 1. **App name**: Enter the name for your application. 2. **ADD DESCRIPTION** (optional): Enter a short description of the application. 3. **Authentication method**: Select the default **API Key** as the method of authentication from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.* 4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-for-mongodb-encryption-at-rest-linux#33-creating-a-group) from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 3.5 Copying the App UUID Perform the following steps to copy the app UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-for-mongodb-encryption-at-rest-linux#34-creating-an-application) to go to the detailed view of the app. 2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 3.6: Generating the Certificat*](/v1/docs/using-fortanix-data-security-manager-for-mongodb-encryption-at-rest-linux#36-generating-the-certificate)[*e*](/v1/docs/using-fortanix-data-security-manager-for-mongodb-encryption-at-rest-linux#26-generating-the-certificate) as the value of Common Name (CN) to generate a Certificate Signing Request (CSR). ### 3.6 Generating the Certificate Change directory to `SDKMS_Certs` and run the following command to generate a self-signed certificate: ```bash openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 -days 365 -out certificate.crt ``` ![mysql.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360095605932.png) **Figure 4: Create self-signed certificate** When prompted for a Common Name, you should enter the Fortanix DSM app in [*Section 2.5: Copying the App UUID*](/v1/docs/using-fortanix-data-security-manager-for-mongodb-encryption-at-rest-linux#25-copying-the-api-key). The generated certificate will have the app ID as CN. ![mysql2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360095531071.png) **Figure 5: Certificate generated** Examine the subject in the certificate to verify it contains the app ID as CN. A correctly generated certificate should look as follows (note the value of CN). ```bash Certificate:    Data:        Version: 3 (0x2)        Serial Number: 11285796284824083476 (0x9c9f33ed245cdc14)    Signature Algorithm: sha256WithRSAEncryption        Issuer: C=US, ST=CA, L=Mountain View, O=Fortanix, OU=Test, CN=da7f2800-4122-4681-aebf-90beb779b73f/emailAddress=test@fortanix.com        Validity            Not Before: Aug  8 23:31:20 2018 GMT            Not After : Aug  8 23:31:20 2019 GMT        Subject: C=US, ST=CA, L=Mountain View, O=Fortanix, OU=Test, CN=da7f2800-4122-4681-aebf-90beb779b73f/emailAddress=test@fortanix.com        Subject Public Key Info:            Public Key Algorithm: rsaEncryption                Public-Key: (2048 bit)                Modulus:                    00:d2:ae:15:66:bf:78:d4:98:f4:4d:a5:57:bf:04:                    08:76:83:1f:40:e8:8b:c4:da:8a:a0:71:22:43:84:                    6d:c9:05:f2:81:91:83:04:75:bd:c9:83:86:92:bf:                    ff:a0:e4:b4:e4:ee:56:09:10:2a:dc:e2:f4:0c:65:                    43:96:a1:31:0d:15:92:49:87:ee:46:91:5d:f1:8c:                    61:b3:ca:4a:9f:be:01:00:d5:30:5f:ee:56:35:75:                    3c:e1:0d:a6:34:66:7f:3b:26:69:97:33:6d:2e:c7:                    fd:c9:42:7d:14:f7:12:18:4a:5b:a6:90:52:7a:4b:                    1b:45:b3:79:33:31:99:03:1d:a4:ed:51:dc:7b:43:                    20:02:bb:08:22:27:27:8c:51:6a:5f:59:87:45:95:                    d7:f3:ca:fa:30:3d:d5:a6:50:77:03:e3:de:eb:30:                    17:45:48:fe:5b:76:d4:c1:03:3f:b8:99:73:ae:ad:                    ae:e2:69:95:e2:14:1e:42:b1:ac:72:cd:0b:c6:01:                    e3:20:8d:5a:6a:5d:19:79:17:f0:80:5f:75:fc:d5:                    da:9c:af:07:d8:c7:96:02:a5:94:19:64:d7:9a:e4:                    56:f1:cf:54:b9:a7:29:28:22:52:f2:c4:8a:97:04:                    45:b1:9b:b5:4f:c0:18:53:ff:08:3f:3b:81:bd:f1:                    d1:e9                Exponent: 65537 (0x10001)        X509v3 extensions:            X509v3 Subject Key Identifier:                87:65:C6:B6:B6:3A:0A:A6:30:BA:CB:D2:27:9E:C4:E6:2E:7F:2F:6D            X509v3 Authority Key Identifier:                keyid:87:65:C6:B6:B6:3A:0A:A6:30:BA:CB:D2:27:9E:C4:E6:2E:7F:2F:6D            X509v3 Basic Constraints:                CA:TRUE    Signature Algorithm: sha256WithRSAEncryption         71:da:8c:da:ab:9d:6d:8a:f1:9c:56:a9:7d:e2:e2:1b:fd:90:         b7:5e:45:db:d4:69:47:ca:98:2f:b0:3b:2c:1f:49:3a:75:dd:         1d:96:b3:bd:11:a6:d7:06:60:4f:18:11:e1:cf:db:5c:52:03:         29:78:47:6e:36:c0:64:d8:4d:34:00:d9:94:55:48:a9:d4:b2:         b2:ed:b8:13:fc:3d:c6:b4:61:a3:56:aa:9d:73:80:62:38:da:         0c:94:b0:4a:e6:86:da:6a:f9:aa:f3:a4:3c:48:32:93:f7:d3:         27:f9:2c:77:b4:91:9c:84:62:96:86:7d:d2:c8:20:79:d1:12:         ef:f0:cc:15:31:ea:86:e9:b4:02:00:55:83:0f:6a:c6:5b:d2:         19:67:9b:b2:44:f8:3b:36:f9:b0:02:b2:98:7d:1e:fa:95:58:         92:92:57:68:f8:56:bb:43:db:01:08:bb:d6:ab:52:e6:c7:88:         7a:1c:8d:f4:31:90:70:0a:dd:d2:96:7c:8b:93:8f:1f:4a:80:         fe:3a:f8:df:82:a7:99:ac:2f:e8:02:e5:8b:fe:ec:3b:3b:0a:         a3:c0:82:4d:f7:93:66:a1:76:6f:fa:c2:19:8e:d8:b6:b4:27:         8c:57:22:a4:f7:e6:45:61:27:af:fc:5f:51:88:eb:32: ``` ### 3.7 Updating the Authentication Method Perform the following steps to change the authentication method: 1. Go to the detailed view of the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-for-mongodb-encryption-at-rest-linux#34-creating-an-application) and then click **Change authentication method** and select **Certificate** to change the authentication method to Certificate. 2. Click **SAVE**. 3. On the **Add certificate** dialog box, click the **UPLOAD NEW CERTIFICATE** to upload the certificate file or paste the content of the certificate generated in previous section. 4. Select both check boxes to confirm your understanding of the action. 5. Click **UPDATE** to save the changes. ## 4.0 Configuring Encryption in MongoDB You need to start MongoDB with the options to configure encryption and point it to Fortanix DSM as the key manager. MongoDB will use the certificate you created in the earlier step to authenticate to Fortanix DSM. > [!NOTE] > NOTE > > - If you already have data in MongoDB then starting MongoDB with encryption enabled will not work. > - The certificate needs to be in PEM format. > - It needs the private key and certificate to be concatenated together in one file. Copy your private key followed by a certificate in a file, say `client.pem`. It should look as follows: ```bash -----BEGIN PRIVATE KEY----- MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC5/MzwY4GcIkyU ………………………………………………………………………………………………………………………………………………………………………. 9R9EpY5ob2xaorfyEDZR2A== -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIEUTCCAzmgAwIBAgIJAJxAy7ghYZjwMA0GCSqGSIb3DQEBCwUAMIG+MQswCQYD ………………………………………………………………………………………………………………………………………………………………………. 7Do/CpP2WqIk5uojq4SO5Z+/8zs0rzVNwYaKnyMSmxO+c3bC4guYB/vdEcT1wXzy bDh/HRo= -----END CERTIFICATE----- ``` To start MongoDB with encryption enabled and use a new master key, start with the following options: ```bash /usr/bin/mongod --enableEncryption --kmipServerName   --kmipPort 5696 --kmipServerCAFile SDKMS_CA.pem --kmipClientCertificateFile client.pem ``` Explanation of parameters: | --enableEncryption | Enable encryption at rest | | --- | --- | | --kmipServerName arg | Fortanix DSM hostname | | --kmipPort arg | KMIP server port (defaults to 5696) | | --kmipClientCertificateFile arg | Client certificate for authenticating to Fortanix DSM server | | --kmipServerCAFile arg | CA File for validating connection to the Fortanix DSM server. | *For more information on MongoDB encryption at rest and other configuration options, refer to* [*MongoDB Manual*](https://docs.mongodb.com/master/core/security-encryption-at-rest/)*.* Once MongoDB starts and connects to Fortanix DSM successfully, it will request Fortanix DSM to generate a master key (AES-256). You can check this in Fortanix DSM UI in the Security Objects page. Every time, MongoDB is restarted it will retrieve the value of Master Key from Fortanix DSM after authenticating with it. With Fortanix DSM you will see a complete audit trail if every time this master key is retrieved. You will also have complete control over the master key and you can revoke access to the key or disable it, in case you want to lock down your data at rest. The following screenshot shows the activity logs for the MongoDB application and an audit trail of the master key usage. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768854252127.png) **Figure 6: Activity logs** Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. ## Related - [Application Authentication with Client Certificate](/dsm-example-code-app-authentication-with-client-certificate.md) - [Fortanix DSM as External KMIP in Rubrik](/fortanix-dsm-as-external-kmip-in-rubrik.md) - [Fortanix DSM for MySQL Encryption at Rest](/fortanix-dsm-for-mysql-encryption-at-rest.md) - [Single Sign-On](/dsm-single-sign-on.md) - [Fortanix DSM with MongoDB Encryption at Rest - Windows](/fortanix-dsm-with-mongodb-encryption-at-rest-windows.md)