---
title: "Fortanix DSM with Microsoft IIS"
slug: "fortanix-dsm-with-microsoft-iis-integration-guide"
updated: 2026-07-08T17:02:13Z
published: 2026-07-08T17:02:13Z
canonical: "support.fortanix.com/fortanix-dsm-with-microsoft-iis-integration-guide"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Microsoft IIS

## 1.0 Introduction

This article explains how to configure Microsoft Internet Information Services (IIS) to use **Fortanix-Data-Security-Manager (DSM)** to provide full key life-cycle management to reduce the cryptographic load on the host server CPU.

## 2.0 Prerequisites

Ensure the following:

- Fortanix KMS client version 4.8 or later ([Download](https://fortanix.zendesk.com/hc/en-us/sections/27488968118932-CNG-EKM))
- Fortanix app API key
- Admin Access to the Microsoft IIS server

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(32).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(30).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-iis-integration-guide#33-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-iis-integration-guide#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 4.1: Configuring the KMS Client*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-iis-integration-guide#41-configuring-the-kms-client).

### 3.6 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in *Section 3.4: Creating an Application* to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use in [*Section 4.1: Configuring the KMS Client*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-iis-integration-guide#41-configuring-the-kms-client).

## 4.0 Integration Procedure

### 4.1 Configuring the KMS Client

*For more information on how to configure the KMS client, refer to* [*Clients: Microsoft CNG Key Storage Provider*](/v1/docs/clients-microsoft-cng-key-storage-provider)*.*

### 4.2 Installing Microsoft IIS

Perform the following steps if the Microsoft IIS server is not already installed on your system:

1. Select **Start** → **Windows Administrative Tools** → **Server Manager** to open the Server Manager Dashboard.
2. In the Server Manager toolbar, select **Quick Start** → **Configure this local server** → **Add roles and features**.
3. In the **Add Roles and Features** wizard, proceed to the **Installation Type** tab, then continue through the wizard to install **Web Server (IIS)**.
4. Select the **Default** (or required) components from within the wizard and complete the Microsoft IIS installation process.

### 4.3 Creating Certificate Request

You can generate a Microsoft IIS certificate request using an encryption key stored in Fortanix DSM.

1. Create a file named `request.inf` with the following information:

> [!NOTE]
> NOTE
> 
> Remove the <> brackets while editing.

```bash
[Version]
Signature= "$Windows NT$"
[NewRequest]
Subject = "C=<country_code>,CN=<common_name>,O=<company_name>,OU=<object>,L=<locality_name>,S=<state_name>"
HashAlgorithm = SHA256
KeyAlgorithm = RSA
KeyLength = 2048
ProviderName = "Fortanix KMS CNG Provider"
KeyUsage = "CERT_NON_REPUDIATION_KEY_USAGE | CERT_DIGITAL_SIGNATURE_KEY_USAGE | CERT_KEY_ENCIPHERMENT_KEY_USAGE"
MachineKeySet = True
KeyContainer = "IIS-testing-key"
[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1
```

Complete configuration example,

```bash
[Version]
Signature= "$Windows NT$"
[NewRequest]
Subject = "C=US,CN=www.IISDemo.com,O=Fortanix,OU=certobject,L=BS,S=CA"
HashAlgorithm = SHA256
KeyAlgorithm = RSA
KeyLength = 2048
ProviderName = "Fortanix KMS CNG Provider"
KeyUsage = "CERT_NON_REPUDIATION_KEY_USAGE | CERT_DIGITAL_SIGNATURE_KEY_USAGE | CERT_KEY_ENCIPHERMENT_KEY_USAGE"
MachineKeySet = True
KeyContainer = "IIS-testing-key"
[EnhancedKeyUsageExtension]
OID = 1.3.6.1.5.5.7.3.1
```

> [!NOTE]
> NOTE
> 
> For different `KeyUsage` options, refer to [*Microsoft’s KB article*](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certreq_1).
2. Run the following command to request the certificate:

```bash
certreq.exe -new request.inf IIStesting.csr
```

![Figure_0.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/figure_0.png)

**Figure 4: Command output**

This command creates a security object (key) in Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/IIS-SO(1).png)

**Figure 5: Key created in Fortanix DSM**
3. Sign the certificate using the Certificate Authority (CA) of your choice.

For example,
  - Submit a new request in Active Directory Certificate Services (ADCS).
  - Issue the pending certificate.
4. Obtain the signed certificate. For example, copy the ADCS signed certificate to a file.
5. Run the following command to accept the certificate:

```bash
certreq -accept IIStesting.crt
```

![Figure_2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/figure_2.png)

**Figure 6: Commands**

Alternatively, double-click the certificate file and select Install to add it to the local personal certificate store.
6. Bind the signed certificate to Microsoft IIS.

![Figure_3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/figure_3.png)

**Figure 7: Bind the certificate**
7. Test the configuration.

![Figure_4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/figure_4.png)

**Figure 8: Test configuration**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [CMK Rotation - Fortanix DSM Version Below 5.6](/cmk-rotation-fortanix-dsm-version-below-5-6.md)
- [Fortanix DSM to Create Tokenization Secret](/fortanix-dsm-to-create-tokenization-secret.md)
- [Fortanix DSM with Microsoft PKI](/fortanix-dsm-with-microsoft-pki.md)
- [Microsoft CNG Key Storage Provider](/fortanix-dsm-clients-microsoft-cng-key-storage-provider.md)