--- title: "Fortanix DSM with EDB Postgres for TDE" slug: "fortanix-dsm-with-edb-postgres-for-tde" updated: 2026-08-19T15:57:14Z published: 2026-08-19T15:57:14Z canonical: "support.fortanix.com/fortanix-dsm-with-edb-postgres-for-tde" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM with EDB Postgres for TDE ## 1.0 Introduction This article describes the integration procedure for **Fortanix-Data-Security-Manager (DSM)** and **Postgres Enterprise Database (EDB)** to enable Transparent Data Encryption (TDE). This article provides detailed information on the following: - Enabling secure communication and authentication between Fortanix DSM and Postgres EDB through the utilization of Key Management Interoperability Protocol (KMIP) and certificates. - Configuring and initializing Fortanix DSM. - Generating client certificates to enhance security as part of the integration process. - Generating Postgres master key and encrypting the database. ## 2.0 KMIP and Certificate Requirements This section outlines the essential requirements for the Key Management Interoperability Protocol (KMIP) and certificates in the integration process. KMIP plays a crucial role in enabling secure communication between EDB Postgres and Fortanix DSM. It leverages Transport Layer Security (TLS) to establish a secure connection, and Fortanix DSM uses this protocol to authenticate KMIP clients to effectively manage and utilize keys stored within Fortanix DSM. Additionally, X.509 certificates are used to facilitate secure communication and authentication between both Fortanix DSM and Postgres. Fortanix DSM is configured with a server certificate signed by an internal Certificate Authority (CA). Furthermore, it is necessary to generate a client certificate for EDB Postgres using tools such as OpenSSL. This certificate can either be signed externally or self-signed. ## 3.0 Prerequisites Ensure the following: - A functioning EDB Postgres distribution. - Fortanix DSM version 4.4 or later must be installed and operational. - Fortanix DSM must be accessible by EDB Postgres on port 5696 (default) or on a custom KMIP port, if configured. - Users must have access to OpenSSL or another suitable tool for generating a client certificate and private key in the Privacy Enhanced Mail (PEM) format. - Python and the PyKMIP utility must be installed on your server. > [!NOTE] > NOTE > > These requirements are only applicable to versions 15.2 and later of EDB Postgres Advanced Server and versions 15.2 and later of EDB Postgres Extended Server, as only these versions support TDE. ## 4.0 Configure Fortanix DSM A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections: ### 4.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 4.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png) **Figure 1: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ### 4.3 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png) **Figure 3: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a name for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create the new group. *For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.* > [!NOTE] > TIP > > It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.* ### 4.4 Creating an Application Perform the following steps to create an application (app) in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(49).png) **Figure 3: Add application** 2. On the **Adding new app** page: 1. **App name**: Enter the name for your application. 2. **ADD DESCRIPTION** (optional): Enter a short description of the application. 3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to* [*Authentication*](/v1/docs/dsm-authentication)*.* 4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#43-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 4.5 Copying the App UUID Perform the following steps to copy the app UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.4: Creating an Application*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#44-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app. 2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 4.8: Generating the Certificate*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#48-generating-the-certificate) as the value of Common Name (CN) to generate a self-signed certificate and a private key. ### 4.6 Creating a Security Object Perform the following steps to generate an AES key in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(19).png) **Figure 4: Adding security object** 2. On the **Add new Security Object** page: 1. **Security Object name**: Enter the name for your security object. 2. **Group**: Select the group as created in [*Section 4.3: Creating a Group*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#43-creating-a-group). 3. Select **GENERATE**. 4. In the **Choose a type** section, select the **AES** key type. 5. In the **Key Size** section, select the size of the key in bits. 6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying. > [!NOTE] > NOTE > > Ensure that the **Encrypt** and **Decrypt** permissions are selected. 3. Click **GENERATE** to create the new security object. *For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.* ### 4.7 Copying the Security Object UUID Perform the following steps to copy the security object UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click the security object created in [*Section 4.6: Creating a Security Object*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#46-creating-a-security-object) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the security object. 2. From the top of the security object’s page, click **COPY ID** drop down and select **COPY UUID** to copy the UUID to use for your `PGDATAKEYWRAPCMD` and `PGDATAKEYUNWRAPCMD` commands. ### 4.8 Generating the Certificate If an application or client requires certificate-based authentication to Fortanix DSM, it is essential to embed the app UUID within the certificate as the value of the Common Name (CN), as described above. For example, **CN: ae044928-f670-48d1-a4aa-111baf5640a6**. Perform the following steps to create a self-signed certificate, ensuring you have the app UUID to include in the self-signed certificate: 1. Run the following command to log in to your EDB Postgres distribution system as the database superuse: ```bash sudo su - enterprisedb ``` 2. Run the following command to create a `dsm` folder in Linux machine and enter to the folder: ```bash mkdir dsm cd dsm ``` 3. Run the following command to generate an RSA key for authentication with Fortanix DSM: ```bash openssl req -newkey rsa:2048 -nodes -keyout client-key.pem -x509 -days 365 -out client-cert.pem ``` When prompted for the Common Name, enter the Fortanix DSM app UUID as copied in [*Section 5.5: Copying the App UUID*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#45-copying-the-app-uuid). This process will generate two essential files: ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image(96).png) **Figure 5: Create certificate** > [!NOTE] > NOTE > > The given procedure is with Self Signed Certificate, but Fortanix DSM can also support CA Signed Certificate, if preferred by the user. - `client-cert.pem` - `client-key.pem` ### 4.9 **Updating the Authentication Method** Perform the following steps to change the authentication method: 1. Go to the detailed view of the app created in [*Section 4.4: Creating an Application*](/v1/docs/fortanix-dsm-with-edb-postgres-for-tde#44-creating-an-application) and click **Change authentication method** and select **Certificate** to change the authentication method to Certificate. 2. Click **SAVE**. 3. The certificate content can be read using the command `cat client-cert.pem`: ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image(98).png) **Figure 6: Certificate content** 4. On the **Add certificate** dialog box, click **UPLOAD NEW CERTIFICATE** to upload the certificate file or paste the content of the certificate generated in previous section. 5. Select both check boxes to confirm your understanding of the action. 6. Click **UPDATE** to save the changes. ## 5.0 Install TDE-KMIP Client on the Server If you do not have the KMIP client installed, perform the following steps to install the `edb-tde-kmip-client` on your system as a root user: 1. Open a terminal or command prompt. 2. Execute the installation command based on your system. For example, 1. If you are using Linux RHEL server, run the following command: ```bash dnf install edb-tde-kmip-client ``` 2. If you are using Ubuntu server, run the following command: ```bash apt-get install edb-tde-kmip-client ``` ## 6.0 Create the pykmip.conf File Perform the following steps to configure the `pykmip.conf` file: 1. On the system where your EDB Postgres distribution is located, navigate to `/usr/lib/edb/kmip/` to access the `edb_tde_kmip_client.py` client. 2. In the `/usr/lib/edb/kmip` directory, create a file named `pykmip.conf` and provide the following configuration details: - **Host**: The Fully Qualified Domain Names (FQDN) of the KMIP hosts. - **Port**: The KMIP port, typically set to `5696`. - **Keyfile**: The path to the PEM-encoded client certificate key file. - **Certfile**: The path to the PEM-encoded client certificate file. - **ca_certs**: The path to the Fortanix DSM certificate chain. The Fortanix DSM certificate chain shall be retrieved from the browser when navigating to the respective DSM URL. For example, `amer.smartkey.io`. For example, ```bash [client] host= port=5696 keyfile=/var/lib/edb/dsm/client-key.pem certfile=/var/lib/edb/dsm/client-cert.pem ca_certs=/var/lib/edb/dsm/ca.pem ``` *For more information on the* `pykmip.conf` *file and its contents, refer to the* [*PyKMIP official documentation*](https://pykmip.readthedocs.io/en/latest/client.html)*.* ## 7.0 Verifying the Encryption and Decryption To ensure that the key you have created can successfully encrypt and decrypt data, execute the following two commands as the superuser on your system with the EDB Postgres distribution: ### 7.1 Encrypting the Data Run the following command: If encryption is successful without any error, the file `test.bin` will be created. The corresponding encryption logs are available in the Fortanix DSM. ```bash printf secret | python3 /usr/edb/kmip/client/edb_tde_kmip_client.py encrypt --out-file=test.bin --pykmip-config-file=/var/lib/edb/dsm/pykmip.conf --key-uid='173bb3c8-ef16-4e4e-b066-54fe72cdd296' --variant=pykmip ``` Where, - **KMIP client Location**: `/usr/edb/kmip/client/edb_tde_kmip_client.py` - **Output file**: `test.bin` - **Location of PyKMIP configuration file**: `/var/lib/edb/dsm/pykmip.conf` - **Encrypted key output**: TDE key output. - **Variant**: Allows for KMIP compatibility with Fortanix. ### 7.2 Decrypting the Data Run the following command: ```bash python3 /usr/edb/kmip/client/edb_tde_kmip_client.py decrypt --in-file=test.bin --pykmip-config-file=/var/lib/edb/dsm/pykmip.conf --key-uid='173bb3c8-ef16-4e4e-b066-54fe72cdd296' --variant=pykmip ``` If successful, the decryption command will produce the output of the original "secret." The corresponding encryption and decryption logs are available in the Fortanix DSM. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768853348154.png) **Figure 7: Log details** ## 8.0 Key Rotation This section provides the steps to securely rotate the KEK in a TDE setup. ### 8.1 Rotating the Key Encryption Key This section describes the steps to change the Master Encryption Key (MEK). You need to manually execute the unwrap command, specifying the old key, and then provide the output to the wrap command, specifying the new key. These operations can be performed while the database server is running. The wrapped data key is used only on startup and is not utilized during the server's runtime. The following is the unwrap command: ```bash python3 /usr/lib/edb/kmip/edb_tde_kmip_client.py decrypt --in-file=key.bin --pykmip-config-file=/var/lib/edb-as/dsm/pykmip.conf  --key-uid='' --variant=pykmip ``` The following is the wrap command: ```bash python3 /usr/lib/edb/kmip/edb_tde_kmip_client.py encrypt --out-file=key.bin --pykmip-config-file=/var/lib/edb-as/dsm/pykmip.conf --key-uid='' --variant=pykmip ``` Perform the following steps to rotate the encryption key: 1. Run the following commands to create a new AES 256 key using `pykmip`: ```bash cd ~/pykmip/ python3.9 ./kmip/demos/pie/create.py -a AES -l 256 ``` The following is the output: ```bash 2024-09-11 10:05:39,278 - demo - INFO - Successfully created symmetric key with ID: 34816dab-24e5-4635- 9990-00684b84a8c4 ``` The key is created in the KMIP vault. 2. Run the following command to change directory to the `pg_encryption` folder in the database: ```bash cd $PGDATA/pg_encryption ``` For example, ```bash cd /var/lib/edb-as/16/data/pg_encryption ``` 3. Run the following command to save the original `key.bin` file: ```bash cp key.bin key.bin.original ``` 4. Run the following commands to create the new `key.bin` file based on the newly created key: ```bash python3.9 /usr/edb/kmip/client/edb_tde_kmip_client.py decrypt --pykmip-config-file=/etc/pykmip/pykmip.conf --key-uid="" --in-file=key.bin --variant=pykmip | python3.9 /usr/edb/kmip/client/edb_tde_kmip_client.py encrypt --out-file=key.bin --pykmip-config-file=/etc/pykmip/pykmip.conf --key-uid="" --variant=pykmip ``` Where, For example, ```bash python3 /usr/lib/edb/kmip/edb_tde_kmip_client.py decrypt --in-file=key.bin --pykmip-config-file=/var/lib/edb-as/dsm/pykmip.conf --key-uid='' --variant=pykmip | python3 /usr/lib/edb/kmip/edb_tde_kmip_client.py encrypt --out-file=key.bin --pykmip-config-file=/var/lib/edb-as/dsm/pykmip.conf --key-uid='' --variant=pykmipThis command creates a new key.bin file. ``` - `<Current Key ID>` refers to the ID of the key currently in use to decrypt the data encryption key. - `<New Key ID>` refers to the ID of the newly created key that will be used for future decryption operations after key rotation. 5. Navigate to the data directory PGDATA and edit the `postgresql.conf` file. 6. Change the key in the `data_encryption_key_unwrap_command` under the Authentication section in the `postgresql.conf` file: ```bash data_encryption_key_unwrap_command = 'python3.9 /usr/edb/kmip/client/edb_tde_kmip_client.py decrypt --pykmip-config-file=/etc/pykmip/pykmip.conf --key-uid="" --in-file=%p --variant=pykmip' ``` 7. Run the following command to back to the `HOME` directory: ```bash cd ``` 8. Run the following command to stop the database: ```bash /usr/edb/as16/bin/pg_ctl -D /var/lib/edb/as16/data -l $HOME/logfile stop ``` The following is the output of the command: ```bash waiting for server to shut down.... done server stopped ``` 9. Run the following command to start the database: ```bash /usr/edb/as16/bin/pg_ctl -D /var/lib/edb/as16/data -l $HOME/logfile start ``` The following is the output of the command: ```bash waiting for server to start.... done server started ``` 10. Run the following command to connect to the database: ```bash /usr/edb/as16/bin/psql hr ``` 11. Run the following command to attempt to read the data in the dept table: ```bash hr=# SELECT * FROM dept; ``` The following is the output of the command: ```bash deptno |   dname    |   loc --------+------------+----------     10 | ACCOUNTING | NEW YORK     20 | RESEARCH   | DALLAS (2 rows) ``` The key rotation is successful when the system can access and decrypt the data. ## 9.0 Perform initdb for the Database After creating the key and verifying encryption and decryption, you can export the `PGDATAKEYWRAPCMD` and `PGDATAKEYUNWRAPCMD` to wrap and unwrap your encryption key and initialize your database. Perform the following steps: 1. Navigate to the `/bin` directory where your executables are located. For example, ```bash cd /usr/edb/as15/bin ``` 2. Perform your `initdb` as required for your database. For example, ```bash ./initdb --data-encryption -D /var/lib/edb/as15/data ``` 3. If the initialization is successful, your output should confirm this. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/InitDB.png) 1. Start your database using the following command: ```bash ./pg_ctl -D /var/lib/edb/as15/data -l logfile start ``` The following is the output of the command: ```bash waiting for server to start.... done server started ``` 1. Navigate to your `/data` directory to view the `postgresql.conf` file. Ensure that your `data_encryption_key_unwrap_command`, which you have set with export `PGDATAUNWRAPCMD`, is present under the Authentication section in the `postgresql.conf` file. *For more information on how Transparent Data Encryption (TDE) is integrated with EDB Postgres Advanced Server and EDB Postgres Extended Server, refer to the* [*EDB Transparent Data Encryption documentation*](https://www.enterprisedb.com/docs/tde/latest/)*.* Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface. ## Related - [Fortanix DSM with Veritas NetBackup](/fortanix-dsm-with-veritas-netbackup.md) - [Azure Connection - User Interface Components](/fortanix-key-insight-user-interface-components-azure.md)