---
title: "Fortanix DSM with MinIO (KES Server)"
slug: "fortanix-dsm-with-minio-kes-server"
updated: 2026-08-19T15:15:39Z
published: 2026-08-19T15:15:39Z
canonical: "support.fortanix.com/fortanix-dsm-with-minio-kes-server"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with MinIO (KES Server)

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **MinIO’s Key Encryption Service (KES)** server that uses Fortanix DSM as a persistent and secure key store. KES server runs inside Kubernetes and distributes cryptographic keys to Fortanix DSM applications.

## 2.0 Architecture Workflow

![KES-Architecture.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/kes-architecture.png)

**Figure 1: KES with DSM architecture**

KES Server acts as a bridge between the Fortanix DSM and cloud-native applications. Here Fortanix DSM serves as the central KMS that protects the master keys and acts as the root of trust in your infrastructure. Instead of deploying and managing a separate KMS for each set of applications, when an application wants to encrypt data, it can request a new DEK from a KES server or ask the KES server to decrypt an encrypted DEK. This reduces the load on the central KMS (Fortanix DSM), as KES can handle the majority of application requests without directly interacting with Fortanix DSM. *For more information, refer to* [*https://blog.min.io/introducing-kes/*](https://blog.min.io/introducing-kes/)*.*

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 2: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png)

**Figure 3: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(21).png)

**Figure 4: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to* [*Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/fortanix-dsm-with-minio-kes-server#33-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/fortanix-dsm-with-minio-kes-server#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it later.

## 4.0 KES Server Setup

First, you need to generate a TLS private key and certificate for the KES server. A KES server can only be run with TLS - since [secure-by-default](https://en.wikipedia.org/wiki/Secure_by_default). Here we use self-signed certificates for simplicity. For a production setup, we highly recommend using a certificate signed by CA. For example, your internal CA or a public CA such as [*Let's Encrypt*](https://letsencrypt.org/).

### 4.1 Generating a TLS Private Key and Certificate for the KES Server

The following command will generate a new TLS private key `server.key` and a `X.509` certificate `server.cert` that is self-signed and issued for the IP `127.0.0.1` and DNS name `localhost` (as SAN). You may want to customize the command to match your setup.

```bash
kes tool identity new --server --key server.key --cert server.cert --ip "127.0.0.1" --dns localhost
```

Any other tooling for X.509 certificate generation works as well. For example, you could use `openssl`:

```bash
$ openssl ecparam -genkey -name prime256v1 | openssl ec -out server.key
$ openssl req -new -x509 -days 30 -key server.key -out server.cert \
   -subj "/C=/ST=/L=/O=/CN=localhost" -addext "subjectAltName = IP:127.0.0.1"
```

### 4.2 Creating Private Key and Certificate for your Application

```bash
kes tool identity new --key=app.key --cert=app.cert app
```

You can compute the app identity using:

```bash
kes tool identity of app.cert
```

### 4.3 Creating Configuration File

Now, you have defined all entities in your demo setup. Wire everything together by creating the config file `server-config.yml`:

```bash
address: 0.0.0.0:7373
root:    disabled  # We disable the root identity since we don't need it in this guide 
   
tls:
key : server.key
cert: server.cert
   
policy:
  my-app:
     allow:
     - /v1/key/create/my-app*
     - /v1/key/generate/my-app*
     - /v1/key/decrypt/my-app*    
    identities:
    - ${APP_IDENTITY}
   
 keystore:
   fortanix:
     sdkms:
       endpoint: "<your-fortanix-sdkms-endpoint>"    # Use your Fortanix instance endpoint.
       credentials:
         key: "<your-api-key>" # Insert the application's API key
```

### 4.4 Starting the KES Server

Finally, start the KES Server in a new window/tab.

```bash
export APP_IDENTITY=$(kes tool identity of app.cert)
kes server --config=server-config.yml --auth=off
```

Where, `--auth=off` is required since your `root.cert` and `app.cert` certificates are self-signed.

### 4.5 Connecting to the Server

In the previous window/tab, you can now connect to the server using the following commands:

```bash
export KES_CLIENT_CERT=app.cert
export KES_CLIENT_KEY=app.key
kes key create -k my-app-key
```

Where, `-k` is required because your are using self-signed certificates.

### 4.6 Decrypting Data Encryption Keys

Finally, you can derive and decrypt the data keys from the previously created my-app-key.

```bash
kes key derive -k my-app-key
{
   plaintext : ...
   ciphertext: ...
}
```

```bash
kes key decrypt -k my-app-key <base64-ciphertext>
```

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM - Quickstart](/fortanix-data-security-manager-quickstart.md)
- [Fortanix DSM with Scality S3C](/fortanix-dsm-with-scality-s3c.md)
- [Fortanix DSM for Google Workspace Client-Side Encryption](/fortanix-dsm-for-google-workspace-client-side-encryption.md)
- [Enroll a Compute Node (bare metal or VM) - SGX](/fortanix-ccm-enroll-a-compute-node-bare-metal-or-vm-sgx.md)