---
title: "Fortanix DSM with Keyfactor IIS Orchestrator"
slug: "fortanix-dsm-with-keyfactor-iis-orchestrator"
updated: 2026-07-08T17:55:23Z
published: 2026-07-08T17:55:23Z
canonical: "support.fortanix.com/fortanix-dsm-with-keyfactor-iis-orchestrator"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Keyfactor IIS Orchestrator

## 1.0 Introduction

This article describes the configuration steps required on **Fortanix-Data-Security-Manager (DSM)** and **Keyfactor** to store the RSA key pairs for Internet Information Services (IIS) web server certificates.

## 2.0 Architecture Workflow

![Architecture_keyfactorIIS.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909435827476.png)

**Figure 1: DSM with Keyfactor IIS Orchestrator architecture**

The Keyfactor IIS orchestrator can remotely manage certificates and their bindings on Internet Information Server (IIS) websites. During the certificate enrollment process from the Keyfactor Command Portal, an RSA key for the certificate can be generated and stored in Fortanix DSM.

The Universal Orchestrator is part of the Keyfactor software distribution and is available using the Keyfactor Customer Portal.

### 2.1 Keyfactor IIS Orchestrator Workflow

![KeyFactorIIS-Workflow.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16999937510036.png)

**Figure 2: DSM with Keyfactor IIS Orchestrator workflow**

1. A user creates a certificate enrollment request in the Keyfactor Command Portal.
2. The Keyfactor Orchestrator periodically checks for new jobs, and if a new enrollment request is found, it sends a Certificate Signing Request (CSR) generation request to the target machine
3. The target machine, which has the Fortanix CNG client installed and configured, generates the CSR request
4. The CSR is submitted back to the Keyfactor Orchestrator, which then forwards it to the Command Portal for signing.
5. The Keyfactor Command Portal must be pre-configured with the desired Certificate Authority (CA) to submit the signing request.
6. The Keyfactor Command Portal then sends the signed certificate back to the Keyfactor Orchestrator.
7. The Keyfactor Orchestrator installs the certificate in the machine’s trust store and binds it to the IIS Web Server.

## 3.0 Prerequisites

Ensure the following

- Fortanix CNG Client ([*Download*](https://fortanix.zendesk.com/hc/en-us/sections/27488968118932-CNG-EKM)).
  - Fortanix API key to configure the CNG client.
- Windows IIS server admin access to install the CNG client.
- Keyfactor Portal access is required to configure Orchestrator and for the certificate enrollment process.
- Keyfactor Universal IIS Orchestrator version 10.1.1 or later.

## 4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 3: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(41).png)

**Figure 4: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(40).png)

**Figure 5: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-keyfactor-iis-orchestrator#43-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 4.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-keyfactor-iis-orchestrator#44-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it later.

## 5.0 Configure Key Factor IIS Orchestrator

This section describes the steps required to configure the Keyfactor IIS Orchestrator. *For more information, refer to* [*https://github.com/Keyfactor/iis-orchestrator*](https://github.com/Keyfactor/iis-orchestrator)*.*

1. **Register the IIS universal Orchestrator with Keyfactor** See the Keyfactor documentation, `InstallingKeyfactorOrchestrators.pdf`. *For more information, contact your Keyfactor representative.* Also make sure the IISU extension is enabled or configured on the Keyfactor Orchestrator.

![KeyfactorOrcRegister.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909574189972.png)

**Figure 6: Register IIS Orchestrator with Keyfactor**
2. **Create the new certificate store type for the IIS Orchestrator**: On the Keyfactor homepage, go to **Settings (cog wheel icon)** → **Certificate Store Types** → **ADD**

![AddCertStore.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909574190100.png)

**Figure 7: Add Certificate Store**
  - Certificate Store Type settings: **Basic**

![CertStoreTypeSettingsKeyfactor.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16999937512340.png)

**Figure 8: Certificate store type basic settings**
  - Certificate Store Type settings: **Advanced**

![AdvancedSettingsKeyfactor.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16999937513108.png)

**Figure 9: Certificate store type advanced settings**
  - Certificate Store Type settings: **Custom Fields**

![CertStoreCustomFields.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909574190356.png)

**Figure 10: Certificate store type custom fields**
  - Certificate Store Type settings: **Entry Parameters**

![CertStoreEntryParameters.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909574190868.png)

**Figure 11: Certificate store type entry parameters**

> [!NOTE]
> NOTE
> 
> For the certificate that a reenrollment job is enrolling, the Provider Name field is required to generate and store the private key in the Fortanix DSM.
3. **Create an IIS binding certificate store within the Keyfactor command center**: On the Keyfactor home page, click **Locations** → **Certificate Stores** from the drop down menu.

![AddCertStoreLocation.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909574190996.png)

**Figure 12: IIS Binding certificate store**

![AddCertStore1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909598936852.png)

**Figure 13: Add certificate store**

## 6.0 Certificate Enrollment

Perform the following steps:

1. In the Management Portal, browse to **Locations** → **Certificate Stores**.
2. On the **Certificate Stores** page, select the **Certificate Stores** tab (the default when you first visit the page)
3. On the **Certificate Stores** tab, highlight the certificate to reenroll in the **Certificate Stores** table and click **REENROLLMENT** at the top of the table or right-click the store location in the table and select **Reenrollment** from the right-click menu.
4. On the **Reenrollment** dialog box:

> [!NOTE]
> NOTE
> 
> If you do not select a template or CA for reenrollment, the values configured for the "Template for Submitted CSRs" and/or "Certificate Authority for Submitted CSRs" application setting(s) (see Application Settings in Keyfactor) will be used.
  - **Subject Name** for the new certificate using X.500 format
  - **Port** where to bind the site
  - **IP Address**
  - **SNI Flag**
  - **Protocol**
  - **Provider Name** as `Fortanix KMS CNG Provider`
  - **Site Name**
  - **SAN** (optional)
  - **HostName**
  - **Certificate Authority**
  - Select a **Template**
5. Click **Done** to submit the request.

![CertReenrollment.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909576634644.png)

**Figure 14: Certificate reenrollment**

The reenrollment job will be scheduled to run immediately. Visit the **Orchestrator Jobs** page to check the progress of the job.

![ReenrollmentJob.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909576640020.png)

**Figure 15: Reenrollment job**

### 6.1 Binding

Check the binding status on IIS Site Binding settings.

![BindingStatus.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909586879380.png)

**Figure 16: Binding status**

### 6.2 Certificate

Check the certificate on the IIS server to confirm the cryptographic provider.

![IISServerCert.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/16909587687060.png)

**Figure 17: IIS Server certificate**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM with Keyfactor EJBCA (Primekey)](/fortanix-dsm-with-keyfactor-ejbca-primekey.md)
- [Fortanix DSM as a KMS to Secure VMware Virtual Environments](/fortanix-dsm-as-a-kms-to-secure-vmware-virtual-environments.md)
- [Getting Started with Fortanix DSM - UI](/getting-started-with-fortanix-data-security-manager-ui.md)
- [Fortanix Armor Identity and Access Management (IAM)](/fortanix-armor-identity-and-access-management-iam.md)