---
title: "Fortanix DSM with Keyfactor EJBCA (Primekey)"
slug: "fortanix-dsm-with-keyfactor-ejbca-primekey"
updated: 2026-07-27T16:08:50Z
published: 2026-07-27T16:08:50Z
canonical: "support.fortanix.com/fortanix-dsm-with-keyfactor-ejbca-primekey"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Keyfactor EJBCA (Primekey)

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Enterprise Java Beans Certificate Authority (EJBCA)**.

It also provides the information required to:

- Create an application (app) in Fortanix DSM.
- Configure Fortanix DSM as a crypto token in EJBCA.
- Generate key pairs using the crypto token to create a Certificate Authority (CA).
- Integrate Fortanix DSM with EJBCA using one of the following methods:
  - Using the native Fortanix DSM crypto token (available in EJBCA version 8.0 or later)
  - Using the PKCS#11 driver (required for EJBCA versions earlier than 8.0).

## 2.0 Prerequisites

Ensure the following:

- `sudo` privilege or Root access on the EJBCA server.
- Internet connectivity from the EJBCA server to the Fortanix DSM service.
- Admin access to the EJBCA UI to configure the Crypto Token.

> [!NOTE]
> NOTE
> 
> EJBCA versions 8.0 or later include native Fortanix DSM integration. In these versions, users can create a crypto token directly using the Fortanix DSM option without manually installing the PKCS#11 driver or configuring the DSM endpoint. For earlier EJBCA versions, integration requires installation of the Fortanix PKCS#11 library and manual configuration of the DSM endpoint.

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(39).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(38).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-keyfactor-ejbca-primekey#33-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-keyfactor-ejbca-primekey#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it later.

## 4.0 Create a Crypto Token

EJBCA supports two methods to create a crypto token using Fortanix DSM:

- Using Native Fortanix DSM Crypto Token (Recommended for EJBCA 8.0 and later)
- Using PKCS#11 Integration (Legacy Method)

### 4.1 Using Native Fortanix DSM Integration (Recommended)

This method is recommended for EJBCA versions (8.0 or later) that provide built-in Fortanix DSM support.

Perform the following steps:

1. Access the EJBCA adminweb with a web browser.
2. Click **Crypto Token**s from the **CA Functions** drop down.
3. Click **Create new** to create a new crypto token.
4. On the **New Crypto Token** page,

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot 2026-03-05 at 2.07.52 PM.png)

**Figure 4: Add a new crypto token**

The new crypto token is generated successfully.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot 2026-03-05 at 2.09.13 PM.png)

**Figure 5: New crypto token generated**
  1. **Name**: Enter the name of the crypto token.
  2. **Type**: Select **Fortanix DSM** from the drop down list.
  3. **Fortanix Base Address**: Enter the DSM SaaS URL that you are using. For example, `https://eu.smartkey.io`.
  4. **Authentication Code**: Enter the API key obtained in [*Section 3.5: Copying the API Key*](/v1/docs/using-fortanix-data-security-manager-with-keyfactor-ejbca-primekey#35-copying-the-api-key)*.*
  5. **Repeat Authentication Code**: Re-enter the API key value.
  6. Click **Save** to add a new crypto token.
5. Click **Generate new key pair** to generate a new key pair.

For example,

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot 2026-03-05 at 2.15.45 PM(1).png)

**Figure 6: Generate a key pair**
  - Alias: **signKey2**
  - Key Algorithm: **RSA**
  - Key Specification: **4096**
6. The keys are created successfully, and the crypto token can now be used to create a CA.

### 4.2 Using PKCS#11 Integration (Legacy Method)

This is the legacy and manual method of creating the crypto token using PKCS#11 library.

#### 4.2.1 Installing PKCS#11 Driver

Perform the following steps to install the Fortanix PKCS#11 driver:

1. SSH to the EJBCA server.
2. Download the Fortanix PKCS#11 driver.

```bash
curl -L https://download.fortanix.com/clients/4.2.1500/fortanix-pkcs11-4.2.1500-0.x86_64.rpm -o fortanix-pkcs11-4.2.1500-0.x86_64.rpm
```
3. Install the Fortanix PKCS#11 driver.

```bash
sudo dnf localinstall -y fortanix-pkcs11-4.2.1500-0.x86_64.rpm
rm -rf fortanix-pkcs11-4.2.1500-0.x86_64.rpm
```
4. Change to the `wildfly` user and open the `web.properties` file to edit.

```bash
sudo su - wildfly
vim /opt/ejbca/conf/web.properties
```
5. Add the following to the end of the `web.properties` file.

```bash
cryptotoken.p11.lib.60.name=Fortanix
cryptotoken.p11.lib.60.file=/opt/fortanix/pkcs11/fortanix_pkcs11.so
```
6. Save and close the file and exit the `wildfly` account.

```bash
:wq
exit
```

> [!NOTE]
> NOTE
> 
> To log in to Fortanix DSM from the Docker EJBCA container and create keys, add the following command to `/opt/primekey/bin/start.sh`.
> 
> ```bash
> export FORTANIX_API_ENDPOINT=https://<FORTANIX_DSM_URL>
> ```
> 
> The above command is for Linux only.

#### 4.1.2 Generating a Crypto Token

Perform the following steps:

1. Restart the Wildfly Application Server.

```bash
sudo systemctl restart wildfly
```
2. Access the EJBCA adminweb with a web browser.
3. Click **Crypto Tokens** in the left navigation panel.

![EJBCA-_SelectCrypto.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5708205412884.png)

**Figure 7: EJBCA Adminweb**
4. Click the **Create new...** link to create a new crypto token.

![EJBCA-_CreateCrypto.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5708197994900.png)

**Figure 8: Create new crypto token**

![EJBCA-AddAPIKey.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5708221576084.png)

**Figure 10: Configure crypto token**
  1. In the **Type** field, select **PKCS#11 NG** from the drop down menu.

![EJBCA-CryptoType.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5708169162516.png)

**Figure 9: Crypto token type**
  2. Select **Fortanix** from the **PKCS#11 : Library** drop down menu.
  3. Select **Slot ID** from the **PKCS#11 : Reference Type** drop down menu.
  4. Use the default value for the **PKCS#11 : Reference** field.
  5. Type a **Name** for the Crypto token. For example, **Fortanix**.
  6. Type the **Fortanix App API key** for the **Authentication Code** and the **Repeat Authentication Code** fields.
5. Click **Save** to save the changes.

![EJBCA-Save.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5708230994580.png)

**Figure 11: Save the new crypto token**
6. Use the default name for the key (**signKey**), select the key size (**RSA4096**), and select **Sign and Encrypt** for the key usage.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/2026-03-05_18-03-55.png)

**Figure 12: Key usage**
7. Click **Generate new key pair**.

![EJBCA-CreateKeyPair1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/5708194158996.png)

**Figure 13: Create key pair**
8. Repeat *Steps 6-7* to create the **defaultKey** and **testKey**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/2026-03-05_18-06-52.png)

**Figure 14: Create key pairs**
9. The three keys are created, and the crypto token can now be used to create a CA.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM with Keyfactor IIS Orchestrator](/fortanix-dsm-with-keyfactor-iis-orchestrator.md)
- [Port Requirements](/fortanix-data-security-manager-port-requirements.md)