---
title: "Fortanix DSM with Commvault"
slug: "fortanix-dsm-with-commvault"
updated: 2026-07-08T17:00:24Z
published: 2026-07-08T17:00:24Z
canonical: "support.fortanix.com/fortanix-dsm-with-commvault"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Commvault

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Commvault**.

## 2.0 Prerequisites

Ensure the following:

- Fortanix DSM
- Commvault
- Access to create a certificate for the KMIP server

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_Group(9).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_App(4).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-commvault#33-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-commvault#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 3.6: Generating the Certificate*](/v1/docs/using-fortanix-data-security-manager-with-commvault#36-generating-the-certificate) as the value of Common Name (CN) to generate the self-signed certificate and a private key.

### 3.6 Generating the Certificate

Run the following command to generate the client certificate:

You will use this certificate to upload to the Fortanix DSM app. Ensure to update certificate parameters like country, state, organization, and so on, and ensure that the common name (CN) is set to the Fortanix DSM app UUID.

```bash
openssl req -newkey rsa:2048 -nodes -keyout commvault.key -x509 -days 365 -out commvault.crt
```

![Commvaultcert.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903510718612.png)

**Figure 4: Create a new certificate**

### 3.7 Updating the Authentication Method

Perform the following steps to change the authentication method:

1. Go to the detailed view of the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-commvault#34-creating-an-application) and click **Change authentication method** and select **Certificate** to change the authentication method to Certificate.
2. Click **SAVE**.
3. On the **Add certificate** dialog box, click **UPLOAD NEW CERTIFICATE** to upload the certificate file or paste the content of the certificate generated in previous section.
4. Select both check boxes to confirm your understanding of the action.
5. Click **UPDATE** to save the changes.

## 4.0 Configure Commvault Key Management Server

Perform the following steps to configure the Commvault KMIP to integrate with Fortanix DSM for encryption key management:

1. Log in to the Commvault Command Center using your credentials.

![CommvaultKMS.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903698858388.png)

**Figure 5: Log in to Commvault**
2. Search for **Key Management Server** or navigate to **Manage** → **Security** → **Key Management Servers**.

![CommvaultKMS1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903708583700.png)

**Figure 6: Key management server**
3. Click **Add** or **Configure** a new Key Management Server,
  1. **Name**: Provide a name for the KMIP server.
  2. **Key Length**: Specify the key length.
  3. **Server**: Enter the Fortanix DSM hostname. For example, `amer.smartkey.io`. *For more information on the different regions and the host names, refer to* [*Fortanix DSM SaaS Global Availability Map*](https://support.fortanix.com/docs/fortanix-dsm-saas-global-availability-map)*.*
  4. **Port**: Use port **5696**.
  5. **Upload Certificates**: Upload the self-signed client certificate, its private key, and the Fortanix DSM CA certificate.
  6. Click **Save**.

![CommvaultKMSconfigure.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903812304276.png)

**Figure 7: Configure KMIP server**

![CommvaultKMSconfigure1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Commvault Integration KMIP Server Details.png) **Figure 8: Configure KMIP details**
4. Open **CommCell Console** and select **System**.

![CommvaultKMSconfigure2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903838894100.png)

**Figure 9: Commonvault Commcell console**
  1. Navigate to the **Software Encryption** tab.
  2. Select the Key Management Server configured earlier for encryption.
  3. Click **Save**.
5. Go to **Storage Policies** → Create a new policy.

![CommvaultKMSPolicy.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903863475988.png)

**Figure 10: Create new storage policy**
6. Navigate to **Commvault Command Center** → **Storage**.
  1. Select the storage type (Disk).
  2. Under **Configuration**:

![CommvaultKMSEncryption.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903952834964.png)

**Figure 11: Disk storage configuration**

![CommvaultKMSEncryption1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903953376532.png)

**Figure 12: Configure encryption**
    1. Select the **Key Management Server**.
    2. Enable the **Encrypt** toggle.
7. Execute backup jobs to verify encryption.

![CommvaultKMSRunBackupJob.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5903954127892.png)

**Figure 13: Run backup job**
8. Check the Commvault keys managed by Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Commvault-1.png)

**Figure 14: Verify the key**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Commvault-2(1).png)

**Figure 15: Verify the key**

## 5.0 Key Rotation

Perform the following steps to perform key rotation in Commvault using Fortanix KMS:

1. Go to the **Storage** → **Disk** page in the Commvault Command Center.
2. Select the storage policy you used for testing encryption.
3. In the Configuration tab, change the Key Management Server setting from Fortanix KMS to Built-in Key Management Server.
4. Save the configuration.
5. After saving, revert the Key Management Server setting back to Fortanix DSM.
6. Save the changes again.
7. The **Key Rotation** toggle initiates the key rotation process in the Fortanix KMS.
8. Check the Commvault logs to confirm the successful execution of key rotation and review any key operation entries.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM with NetApp ONTAP](/fortanix-dsm-with-netapp-ontap.md)
- [Getting Started with Fortanix DSM - UI](/getting-started-with-fortanix-data-security-manager-ui.md)
- [Fortanix DSM as External KMIP in Rubrik](/fortanix-dsm-as-external-kmip-in-rubrik.md)
- [Fortanix DSM with Veritas NetBackup](/fortanix-dsm-with-veritas-netbackup.md)