--- title: "Fortanix DSM with Cassandra TDE" slug: "fortanix-dsm-with-cassandra-tde" updated: 2026-07-24T16:55:18Z published: 2026-07-24T16:55:18Z canonical: "support.fortanix.com/fortanix-dsm-with-cassandra-tde" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM with Cassandra TDE ## 1.0 Introduction This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **DataStax Cassandra for Transparent Data Encryption**. It contains the information that a user requires for: - Facilitating the communication and authentication between Fortanix DSM and Cassandra using KMIP and Certificates. - Setting up Fortanix DSM. - Creating client certificates. - Configuring DataStax node for Apache Cassandra. ## 2.0 KMIP and Certificate Requirements The Key Management Interoperability Protocol (KMIP) is used to facilitate communication between the Cassandra cluster and Fortanix DSM. KMIP uses Transport Layer Security (TLS) to provide a secure connection and Fortanix DSM leverages this to authenticate the KMIP client to successfully create, retrieve, and use the keys stored inside Fortanix DSM. X.509 certificates are used to facilitate communication and authentication between Fortanix DSM and the Cassandra cluster . Fortanix DSM is deployed with a server certificate that is signed by the internal Certificate Authority (CA). You will need to create a client certificate for the Cassandra cluster using tools such as OpenSSL. The certificate can either be signed by an external CA or be self-signed. ## 3.0 Prerequisites Ensure the following: - Fortanix DSM version 4.4 or later installed and operational. - Fortanix DSM is accessible by the Cassandra cluster on port 5696 (for default) or a custom KMIP port. - Users should have access to OpenSSL or some other tool for generating a client certificate and private key in the Privacy Enhanced Mail (PEM) format. - Enable the [Java Cryptography Extension (JCE)](https://docs.datastax.com/en/security/5.1/security/secEnableJceUnlimited.html) on DataStax Enterprise. ## 4.0 Configure Fortanix DSM Fortanix DSM supports KMIP clients to authenticate using a certificate through applications (apps). To successfully connect and authenticate the Cassandra cluster with Fortanix DSM, you must also extract the Fortanix DSM internal CA certificate. A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections: ### 4.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 4.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png) **Figure 1: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ### 4.3 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_Group(12).png) **Figure 2: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a name for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create the new group. *For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.* > [!NOTE] > TIP > > It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.* ### 4.4 Creating an Application Perform the following steps to create an application (app) in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click ADD APP to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(58).png) **Figure 3: Add application** 2. On the **Adding new app** page: 1. **App name**: Enter the name for your application. 2. **ADD DESCRIPTION** (optional): Enter a short description of the application. 3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.* 4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#43-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 4.5 Copying the App UUID Perform the following steps to copy the app UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the Apps menu item, and click the app created in [*Section 4.4: Creating an Application*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#44-creating-an-application) to go to the detailed view of the app. 2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 4.6: Generating the Certificate*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#46-generating-the-certificate) as the value of Common Name (CN) to generate a self-signed certificate and a private key. ### 4.6 Generating the Certificate Perform the following steps to generate a client certificate using the app ID as Common Name (CN): 1. Run the following command to change the directory to Fortanix DSM: ```bash mkdir dsm ``` ![DataStax-CreateFolder.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18065474390036.png) 2. Run the following command to generate an RSA key for authenticating with Fortanix DSM: ```bash openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -x509 -days 365 -out client-cert.pem ``` When prompted for Common Name, enter the Fortanix app UUID you noted earlier.![DataStax-CreateRSAKey.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18065445144596.png) This will generate the following two files: ![DataStax-Certificate.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18065459852820.png) - `client-cert.pem` - `client-key.pem` ### 4.7 Updating Client Configuration Perform the following steps to modify the client configuration in the Fortanix DSM UI: 1. For the KMIP app created in [*Section 4.4: Creating an Application*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#44-creating-an-application), ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Client-configuration-KMIP.png) **Figure 4: Update client configuration** 1. Click **Settings**→**CLIENT CONFIGURATION**→**KMIP**. 2. In the **Ignore unknown key operations for** section, select the security object types as required. *For more information, refer to the* [*User's Guide: Account Client Configurations*](https://support.fortanix.com/docs/users-guide-account-client-configurations#23-kmip-clients)*.* 3. Click **SAVE**. ### 4.8 Updating the Authentication Method Perform the following steps to change the authentication method: 1. Go to the detailed view of the app created in [*Section 4.4: Creating an Application*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#44-creating-an-application) and then click **Change authentication method** and select **Certificate** to change the authentication method to Certificate. 2. Click **SAVE**. 3. On the **Add certificate** dialog box, click **UPLOAD NEW CERTIFICATE** to upload the certificate file or paste the content of the certificate generated in [*Section 4.6: Generating the Certificate*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#46-generating-the-certificate). 4. Select both check boxes to confirm your understanding of the action. 5. Click **UPDATE** to save the changes. ## 5.0 Configuration on DataStax Node ### 5.1 Creating the DSM.P12 1. Run the following command to generate a PKCS#12 format file from the PEM files created in [*Section 4.6: Generating the Certificate*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#46-generating-the-certificate): ```bash openssl pkcs12 -export -in client-cert.pem -inkey client-key.pem -name "my-dsm-app" -out client-dsm.p12 ``` ![DataStax-p12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070110327956.png) 2. Run the following command to create a Java KeyStore (JKS) keystore: ```bash keytool -importkeystore -destkeystore kmip_keystore.jks -srcstoretype PKCS12 -srckeystore client-dsm.p12 ``` ![DataStax-JKSKeystore.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070110328340.png) Where, > [!NOTE] > NOTE > > Enter a password for the keystore at the prompt and fill out the host information. - `kmip_keystore.jks`: Refers to the keystore file name that is created. - `client-sdkms.p12`: Refers the PKCS#12 file generated in *Step 1* above. 3. The JKS keystore uses a proprietary format. Run the following command to migrate to PKCS#12 which is an industry-standard format: ```bash keytool -importkeystore -srckeystore kmip_keystore.jks -destkeystore kmip_keystore.jks -deststoretype pkcs12 ``` ![DataStax-JKStoP12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070110330132.png) 4. Run the following command to install the KMIP root certificate into the JKS truststore: ```bash keytool -import -alias kmipCA -file kmipCA -keystore kmip_truststore.jks ``` Where, `KmipCA` is the Fortanix DSM certificate chain. > [!NOTE] > NOTE > > Enter a password for the truststore at the prompt, fill out the host information, and type `yes` when prompted for confirmation. ![DataStax-KMIPRootCert.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070047988884.png) 5. Move the keystore and truststore to a directory accessible by DataStax Enterprise (DSE) and change the file to allow the DSE account read or write access. For example, - Move the file `kmip_keystore.jks` to `/etc/dse/dsm/`. - Move the file `kmip_truststore.jks` to `/etc/dse/dsm/`. 6. Delete or secure the files used to create the keystore and truststore. 7. Add the host details to the `kmip_hosts` section of the `dse.yaml` file: For example, ```bash kmip_hosts:                                                      fortanix:    hosts: :5696    keystore_path: /etc/dse/dsm/kmip_keystore.jks    keystore_type: jks    keystore_password: redhat    truststore_path: /etc/dse/dsm/kmip_truststore.jks    truststore_type: jks    truststore_password: redhat    key_cache_update_millis: 300000 ``` ![DataStax-DSEYaml.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070047990420.png) Where, - `fortanix`: Refers to the `kmip_group_name` which is a user-defined group name that identifies the KMIP host in DSE related commands. - `hosts`: Refers to the comma separated list of fully qualified domain names (FQDN) of KMIP hosts. DSE tries the hosts in the order listed. - `keystore_path`: Refers to the location of the keystore created. - `keystore_type`: Refers to the `jks` keystore format. Must be set to `jks`. - `keystore_password`: Refers to the password of the keystore file created. - `truststore_path`: Refers to the location of the truststore file created. - `truststore_type`: Refers to the `jks` Truststore format. Must be set to `jks`. - `truststore_password`: Refers to the password of the truststore file created. 8. Run the following command to make the `dsm` directory owner as `cassandra`: ```bash chown -R cassandra:cassandra dsm ``` ![DataStax-DSMdirectory.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070110339604.png) 9. Verify that the DataStax node can connect to the KMIP host by listing encryption keys on the remote KMIP server. > [!NOTE] > NOTE > > The `dsetool` picks up the changes from `dse.yaml` file without requiring a restart. ### 5.2 Testing the Connection 1. To test the connection, create a key, for example, **Testkey** of type AES and size 256-bits on Fortanix DSM, and then run the following command: > [!NOTE] > NOTE > > The key must have **Export** permission. ```bash dsetool managekmip list fortanix ``` ![DataStax-testConnection.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070047992980.png) 2. Check the DataStax application audit logs in Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768855290210.png) **Figure 5: Audit log** 3. Delete or keep the key (**Testkey**) created in the above step for testing. ## 6.0 Encrypt the Table ### 6.1 Creating a New Encrypted Table The following example creates a new encrypted table using a key from a KMIP server. ```bash CREATE TABLE table1(   emp_id int PRIMARY KEY,   emp_name text, emp_city text,   emp_sal varint,   emp_phone varint   ) WITH COMPRESSION =    { 'class': 'Encryptor', 'key_provider': 'KmipKeyProviderFactory',    'kmip_host': 'fortanix', 'cipher_algorithm': 'AES', 'secret_key_strength': 128 }; ``` ![DataStax-EncryptedTable.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070047994772.png) ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768855307685.png) **Figure 6: KMIP key** ![DataStax-EncryptedTableKMIPKey1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070047998356.png) Where the first column, that is, **ID** matches with the Fortanix DSM app UUID as copied in [*Section 4.5: Copying the App UUID*](/v1/docs/fortanix-using-fortanix-data-security-manager-with-cassandra-tde#45-copying-the-app-uuid). ### 6.2 Encrypting an Existing Table The following is an example to create an unencrypted table and insert data into the table: ```bash CREATE TABLE unencrypted( emp_id int PRIMARY KEY, emp_name text, emp_city text, emp_sal varint, emp_phone varint ); INSERT INTO unencrypted(emp_id, emp_name, emp_city, emp_phone, emp_sal) VALUES(1,'Dan', 'Eindhoven', 12345678, 50000); select * from unencrypted ; ``` Run the following query to perform encryption without compression: ```bash ALTER TABLE unencrypted WITH COMPRESSION =        { 'class': 'Encryptor',        'key_provider': 'KmipKeyProviderFactory',        'kmip_host': 'fortanix',        'cipher_algorithm': 'AES',        'secret_key_strength': 192}; ``` ![DataStax-ExcryptExisting.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070110359956.png) ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768855325695.png) **Figure 7: KMIP key** ### 6.3 Encrypted Table Properties The following example shows how to describe a namespace to find out encrypted table properties: ```bash DESC KEYSPACE tutorialspoint ; CREATE TABLE tutorialspoint.table1 (    emp_id int PRIMARY KEY,    emp_city text,    emp_name text,    emp_phone varint,    emp_sal varint ) WITH additional_write_policy = '99PERCENTILE'    AND bloom_filter_fp_chance = 0.01    AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}    AND comment = ''    AND compaction = {'class': 'org.apache.cassandra.db.compaction.SizeTieredCompactionStrategy', 'max_threshold': '32', 'min_threshold': '4'}    AND compression = {'chunk_length_in_kb': '64', 'cipher_algorithm': 'AES', 'class': 'org.apache.cassandra.io.compress.Encryptor', 'key_provider': 'KmipKeyProviderFactory', 'kmip_host': 'fortanix', 'secret_key_strength': '128'}    AND crc_check_chance = 1.0    AND default_time_to_live = 0    AND gc_grace_seconds = 864000    AND max_index_interval = 2048    AND memtable_flush_period_in_ms = 0    AND min_index_interval = 128    AND nodesync = {'enabled': 'true', 'incremental': 'true'}    AND read_repair = 'BLOCKING'    AND speculative_retry = '99PERCENTILE'; ``` ![DataStax-namespace.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/18070110362132.png) Run the following command to check if the table is encrypted: ```bash cqlsh:tutorialspoint> DESCRIBE TABLE tutorialspoint.table1 ``` Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.