---
title: "Fortanix DSM with Zoho"
slug: "fortanix-dsm-using-zoho"
updated: 2026-07-08T17:57:39Z
published: 2026-07-08T17:57:39Z
canonical: "support.fortanix.com/fortanix-dsm-using-zoho"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Zoho

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Zoho Bring Your Own Key (BYOK)** feature to use a key from Fortanix DSM as the Key Encryption Key (KEK) in place of Zoho's default KEK.

Zoho offers a suite of cloud-based applications for managing various business functions such as Customer Relationship Management (CRM), finance, and human resources. By integrating Zoho with Fortanix DSM, you maintain full control over your encryption keys, which ensures that your data remains secure and complies with regulatory requirements.

## 2.0 Prerequisites

Ensure the following:

- Fortanix DSM is accessible. *For more information, refer to* [*Section 5.1: Signing Up*](/v1/docs/fortanix-data-security-manager-using-zoho#51-signing-up) *and* [*Section 5.2: Creating an Account*](/v1/docs/fortanix-data-security-manager-using-zoho#52-creating-an-account)*.*

## 3.0 Product Tested Version

The following product versions were tested:

- Fortanix DSM version 4.23 and above.

## 4.0 Architecture Diagram

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Zoho2.png)

**Figure 1: Architecture diagram**

You can configure Fortanix DSM as your external key manager to manage KEKs for encrypting and decrypting the Data Encryption Keys (DEKs) used by Zoho. By integrating with Fortanix DSM, you maintain full control over your encryption operations, enhancing the security of your data.

After you configure the key in Zoho Directory, Zoho sends a request to Fortanix DSM to encrypt its DEKs using the KEK. Fortanix DSM processes this request, encrypts the DEK, and securely returns the encrypted DEK to Zoho. Zoho then stores the encrypted DEK in its internal Key Management Service (KMS).

When Zoho requires the plaintext DEK for operations, it sends a decryption request to Fortanix DSM along with the encrypted DEK. Fortanix DSM decrypts the DEK and securely provides the plaintext DEK to Zoho. Zoho temporarily caches the plaintext DEK for the duration specified by you. Once this caching period ends, Zoho sends a fresh request to Fortanix DSM for encrypting or decrypting the DEK, repeating the process as needed.

## 5.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 5.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 5.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 2: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 5.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(46).png)

**Figure 3: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 5.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(45).png)

**Figure 4: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/fortanix-data-security-manager-using-zoho#53-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 5.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/fortanix-data-security-manager-using-zoho#54-creating-an-application) to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use in [*Section 6.1: Adding a Key from an EKM Provider*](/v1/docs/fortanix-data-security-manager-using-zoho#61-adding-a-key-from-an-external-key-management-ekm-provider).

## 6.0 Configure Zoho

In this section, you will configure Zoho to work with Fortanix DSM as the EKM for securing your DEKs. This process includes adding keys from Fortanix DSM and optionally uploading a key through Zoho Directory.

### 6.1 Adding a Key from an EKM Provider

Perform the following steps:

1. Log in to the Zoho directory with your administrative credentials.
2. Click the **Admin Panel** menu item from the left navigation panel and navigate to **Security**.
3. Select **BYOK**→ **Setup**.
4. If you already have a key added, click **Add Key** from the top-right of the screen.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Zoho-Add-BYOK.png)

**Figure 5: Add BYOK**
5. On the **Add Key** page:
  - **Key Name**: Enter a name for the key.
  - **Available Applications**: Select the applications you want to secure with this key.
  - **Key Type**: Select **Fortanix DSM**,
    - **Key provider**: Select **Google KMS** from the drop down menu.
    - **API key**: Enter the API Key as copied in [*Section 5.5: Copying the API Key*](/v1/docs/fortanix-data-security-manager-using-zoho#55-copying-the-api-key)*.*
    - **Key ID**: Provide the Key ID.
    - **Domain**: Specify the Domain.

> [!NOTE]
> NOTE
> 
> You can retrieve the necessary details such as the API Key, Key ID, and Domain, from the Fortanix DSM user interface (UI).

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Zoho-Fortanix-DSM-KeyType.png)

**Figure 6: Fortanix DSM key type**
  - **Cache Duration**: Select the required duration from the drop-down menu. This setting determines how long the decrypted DEK will be cached before the system needs to send encrypt/decrypt requests to the EKM again.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Zoho-Cache-Duration.png)

**Figure 7: Cache duration**
6. Click **Add** to finish the setup process.

> [!NOTE]
> NOTE
> 
> When configuring BYOK for a specific service, the application is removed from the default key. If the BYOK key is deleted, the application will be added back to the default key.

### 6.2 Uploading a Key Through Zoho Directory

If you prefer to upload your own key instead of using an external key manager (EKM), follow these steps:

#### 6.2.1 Prerequisites

Ensure you have the following:

- A BYOK certificate.
- An encrypted KEK.
- A Hashed KEK.

#### 6.2.2 Adding a BYOK Certificate

Perform the following steps to add and download a certificate in the Zoho directory:

1. Click the **Admin Panel** menu item from the left navigation panel and then navigate to **Security**.
2. Click the **BYOK** menu item, then select **View Certificates** from the top-right corner of the screen.
3. Click **Add Certificates** and provide a unique name for your certificate.
4. Click **Add**.

> [!NOTE]
> NOTE
> 
> You can add up to two certificates.
5. Hover over the added certificate and click the download icon to download it for key generation.

#### 6.2.3 Generating an Encrypted KEK

This section outlines the steps to generate an encrypted KEK by extracting a public key from a certificate, encrypting the AES key with it, and generating a hash for the AES key.

Perform the following steps in a local environment:

1. Run the following command to extract the public key from the downloaded certificate file:

```bash
public static String getPublicKeyFromFile(String fileName) 
throws IOException, CertificateException { 
PemReader reader = new PemReader(new FileReader(new 
File(fileName))); 
PemObject pemObject = reader.readPemObject(); 
byte[] content = pemObject.getContent(); 
reader.close(); 
InputStream fin = new ByteArrayInputStream(content); 
CertificateFactory f = 
CertificateFactory.getInstance("X.509"); 
X509Certificate certificate = 
(X509Certificate)f.generateCertificate(fin); 
PublicKey pk = certificate.getPublicKey(); 
return 
Base64.getEncoder().encodeToString(pk.getEncoded()); 
}
```
2. Run the following command to encrypt the AES key using the RSA public key you extracted from the certificate:

```bash
public static String encryptKeyWithPublicKey(String 
publicKey, byte[] plainKeyBytes) throws Exception{ 
byte[] publicKeyBytes = 
Base64.getDecoder().decode(publicKey);  
X509EncodedKeySpec keySpec = new 
X509EncodedKeySpec(publicKeyBytes); 
KeyFactory keyFactory = KeyFactory.getInstance("RSA"); 
PublicKey publicKey = keyFactory.generatePublic(keySpec); 
Cipher encryptCipher = Cipher.getInstance("RSA/ECB/OAEPWITHSHA-
256ANDMGF1PADDING"); 
OAEPParameterSpec oaepParams = new OAEPParameterSpec("SHA-
256", "MGF1", new MGF1ParameterSpec("SHA-256"), 
PSource.PSpecified.DEFAULT); 
encryptCipher.init(Cipher.ENCRYPT_MODE, publicKey, oaepParams); 
byte[] encryptedBytes = encryptCipher.doFinal(plainKeyBytes); 
return Base64.getEncoder().encodeToString(encryptedBytes); 
}
```
3. Run the following command to generate the AES key hash value:

```bash
public static String getHashValue(byte[] plainKeyBytes) 
throws NoSuchAlgorithmException { 
    MessageDigest digest = MessageDigest.getInstance("SHA-
256"); 
    byte[] hashed = digest.digest(plainKeyBytes); 
    return Base64.getEncoder().encodeToString(hashed); 
}
```

#### 6.2.4 Uploading a Key

Perform the following steps to add a key:

1. Click the **Admin Panel** menu item from the left navigation panel and then navigate to **Security**.
2. Click **BYOK** → **Setup**.
3. If you already have a key added, click **Add Key** from the top-right of the screen.
4. On the **Add Key** page:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Zoho-Add-Certificates.png)

**Figure 8: Add BYOK certificates**
  - **Key Name**: Enter a name for the key.
  - **Available Applications**: Select the applications you want to secure with this key.
  - **Key Type**: Choose the appropriate key type, such as External Key Manager, Upload Key.
  - **BYOK Certificates**: Select the BYOK certificates you have uploaded.
  - **Hashed KEK**: Browse and upload the generated hashed KEK.
  - **Encrypted KEK**: Browse and upload the generated encrypted KEK.
5. Click **Add** to finalize the key upload process.

#### 6.2.5 Managing the Keys

*For more information on how to edit, change, or delete a key, refer to the* [*Zoho official documentation*](https://writer.zohopublic.com/writer/published/l7haw7a26c28b44b34255b3ac6119f1e1bc02)*.*

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.