---
title: "Fortanix DSM with IBM Informix"
slug: "fortanix-dsm-with-ibm-informix"
updated: 2026-07-24T17:01:24Z
published: 2026-07-24T17:01:24Z
canonical: "support.fortanix.com/fortanix-dsm-with-ibm-informix"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with IBM Informix

## 1.0 Introduction

This article describes how to use **Key Management Service (KMS)** in **Fortanix-Data-Security-Manager (DSM)** to manage data in **IBM Informix** storage spaces using Key Management Interoperability Protocol (KMIP)**.**

IBM Informix® is a fast and flexible database that seamlessly integrates SQL, NoSQL/JSON, and time series and spatial data. Its versatility and ease of use make Informix a preferred solution for a wide range of environments, from enterprise data warehouses to individual application development. Also, with its small footprint and self-managing capabilities, Informix is well suited for embedded data-management solutions.

## 2.0 Why Use Fortanix KMS With IBM Informix?

IBM Informix supports storage space (dbspaces, blobspaces, and smart blobspaces) encryption.

The data in encrypted storage spaces is unintelligible without the encryption key. Encrypting storage spaces is an effective way to protect sensitive information that is stored on the disk.

## 3.0 Encrypting Storage Spaces

### 3.1 Prerequisites for Encrypting Storage Spaces

- IBM® Global Security Kit (GSKit) installed to enable storage space encryption. GSKit is installed by default when you install the database server.
- You must have access rights to enable storage space encryption by setting the `DISK_ENCRYPTION` configuration parameter.

### 3.2 Enable Storage Space

Each storage space is encrypted separately with its own encryption key. By default, the encryption cipher is set to AES with 128-bit keys. You can specify a stronger encryption method by including the cipher option in the DISK_ENCRYPTION configuration parameter value.

Any storage space that you create when “storage space encryption” is enabled is automatically encrypted unless you explicitly choose to create it as unencrypted with the `onspaces` utility. If you initialize a new database server before setting the `DISK_ENCRYPTION` configuration parameter, the root dbspace and all storage spaces created prior to this setting will not be encrypted. However, you can encrypt unencrypted storage spaces, including the root dbspace, by running a restore operation that encrypts the spaces.

As mentioned above, each storage space is encrypted with its own Space Encryption Key (SEK). The SEKs are generated by the system (`oninit`) based on a Master Encryption Key (MEK). The MEK is created using the `onkstore` utility and can be stored locally in the keystore created by the `onkstore` utility, or remotely on a Remote Key Server (RKS). In both cases, you must use the `onkstore` utility to create a keystore that contains either the MEK or the credentials necessary to access the MEK on the RKS.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Informix1.png)

**Figure 1: Storage space encryption**

Once you have created and verified your keystore file, enable storage space encryption by setting the `DISK_ENCRYPTION` configuration parameter to point to the keystore you created and then restart the database server. The value of the `DISK_ENCRYPTION` parameter is a comma-separated list of attributes, one of which specifies the path to your keystore file.

## 4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 2: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(54).png)

**Figure 3: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(52).png)

**Figure 4: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-ibm-informix#33-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 4.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-informix#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 5.2: Configuration on IBM Informix*](/v1/docs/using-fortanix-data-security-manager-with-ibm-informix#42-configuration-on-ibm-informix) as the value of Common Name (CN) to generate a self-signed certificate and a private key.

### 4.6 Creating a Security Object

Perform the following steps to generate an AES key in the Fortanix DSM:

1. In the DSM left navigation panel, click the**Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(20).png)

**Figure 5: Adding security object**
2. On the**Add new Security Object** page:
  1. **Security Object Name**: Enter the name for your security object.
  2. **Group**: Select the group as created in [*Section 4.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-ibm-informix#33-creating-a-group).
  3. Select**GENERATE**.
  4. In the **Choose a type** section, select the **AES** key type.
  5. In the **Key Size** section, select the size of the key in bits. Keep it as **256**.
  6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.

> [!NOTE]
> NOTE
> 
> Ensure that **Export** permission is selected.
3. Click**GENERATE**to create the new security object.

*For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.*

## 5.0 Securing Data in IBM Informix

IBM Informix allows keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.

IBM allows six types of Keystore:

```bash
1 - Local Keystore
2 - AWS EAR Keystore
3 - AWS BAR Keystore
4 - KMIP EAR Keystore
5 - AZURE EAR Keystore
6 – AZURE BAR Keystore
```

Fortanix supports KMIP EAR Keystore integration with IBM Informix.

### 5.1 Creating a KMIP Type Keystore

If your remote key server is hosted on a server or cluster that supports the KMIP standard, you can create a single keystore of type **KMIP**. At this time, the same keystore type can be used for both the Storage Space Encryption and Integrated Backup Encryption features.

![Informix2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix2.png)

**Figure 6: Manage the MEK**

### 5.2 Configuration on IBM Informix

Perform the following steps:

1. Log in to the IBM Informix machine and log in as the Informix user as shown below.

![Informix6.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix6.png)

**Figure 7: Log in to Informix**
2. Create a self-signed certificate and ensure that you should have the App-ID available as it will be used to update the Common Name for the self-signed certificate.
3. Create a directory for all certificates to be created for the KMIP keystore. In the following example, a folder called `SDKMS`.

![Informix7.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix7.png)

**Figure 8: Create a directory**
4. Change directory to `SDKMS` and run the following command to create a self-signed certificate.

```bash
openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 -days 365 -out certificate.crt
```

![Informix8.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix8.png)

**Figure 9: Create a self-signed certificate**

![Informix9.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix9.png)

**Figure 10: Certificate generated**
5. To configure the KMIP keystore:
  1. **KMIP Server**: The IP address or hostname where the KMIP server is listening for requests. If the server listens on a port other than the default (5696), specify the custom port.
  2. **KMIP Username**: The username to access the KMIP server.
  3. **KMIP Password**: The password for the given username.
  4. **KMIP Client Certificate File**: A file containing the client certificate, which must also include the corresponding private key.
  5. **KMIP CA Certificate File**: A file containing the root CA certificate used to sign both the KMIP client certificate file and the KMIP server certificate file.
  6. **KMIP Key Name**: The name of the KMIP key used as MEK by the Storage Spaces Encryption feature or as Remote Master Encryption Key (RMEK) by the Integrated Backup Encryption feature.
6. Create the client certificate file using the following command.

```bash
cat certificate.crt private.key > kmip.crt
```

![Informix10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix10.png)

**Figure 11: Client certificate**
7. Create KMIP Certificate file. Export the root certificate of the KMIP Server and save the same as shown in the following figure.

![Informix11.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix11.png)

**Figure 12: KMIP certificate file**
8. Run the following command to create a new KIMP Keystore command.

```bash
onkstore -create -file Fortanix -cipher aes256
```

Where,
  - `Fortanix` is the Keystore file name
  - `cipher` is `aes256`
9. You will now be prompted to select the type of keystore from the Keystore list.

![Informix12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix12.png)

**Figure 13: Select keystore**
10. Select the Keystore as `4-KMIP EAR Keystore` and update the following details.

![Informix13.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix13.png)

**Figure 14: Keystore selected**
11. Once the KMIP keystore has been created, verify the keystore using the following command.

![Informix16.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix16.png)

**Figure 15: Verify the keystore**
12. Navigate to the **Activity Logs** section of the app in the Fortanix DSM to view the logs.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768853937710.png)

**Figure 16: Activity log**

## 6.0 Migrate the Keystore

The convert feature is currently used only for EAR-type keystores. It supports downloading the MEK stored in the RKS (that is a KMIP server) to the local keystore. The old keystore containing the credentials to the RKS will be renamed and replaced with a new keystore of type “`local`”.

![Informix15.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/informix15.png)

**Figure 17: Convert keystore**

Currently, the only option: `1 – Local Keystore` (converting to a local keystore file) is supported. The original keystore file is copied to a backup file (`my_keystore.p12.bak#`) before being overwritten during the conversion.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Command-Line Interface (CLI) for Fortanix DSM (sdkms-cli)](/fortanix-dsm-clients-command-line-interface-cli.md)
- [Port Requirements](/fortanix-data-security-manager-port-requirements.md)
- [Fortanix DSM with IBM Db2](/fortanix-dsm-with-ibm-db2.md)
- [Symmetric Cryptography](/dsm-symmetric-cryptography.md)
- [Fortanix DSM with EDB Postgres for TDE](/fortanix-dsm-with-edb-postgres-for-tde.md)