---
title: "Fortanix DSM with MongoDB Encryption at Rest - Windows"
slug: "fortanix-dsm-with-mongodb-encryption-at-rest-windows"
updated: 2026-07-24T17:04:17Z
published: 2026-07-24T17:04:17Z
canonical: "support.fortanix.com/fortanix-dsm-with-mongodb-encryption-at-rest-windows"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with MongoDB Encryption at Rest - Windows

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Mongo Database (MongoDB)** for built-in encryption at rest.

## 2.0 Fortanix DSM with MongoDB

Data at rest refers to information stored on non-volatile media, such as hard drives or solid-state Drives (SSDs). Ensuring the security of this data is of paramount importance, especially in today's data-driven world. MongoDB, a popular NoSQL database, provides various mechanisms to protect your data at rest on a Windows platform.

Encryption is the first line of defense for securing data at rest. MongoDB offers built-in encryption at rest using WiredTiger encryption. To enable this feature, you must set up encryption key management and configure your MongoDB instance to use encryption.

## 3.0 Product Version Tested

The following product versions were tested:

- MongoDB Enterprise version 7.0.6.
- Fortanix DSM version 4.23.

## 4.0 Prerequisites

Ensure the following:

- Fortanix DSM is accessible. *Refer to* [*Section 5.1: Signing Up*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#51-signing-up) *and* [*Section 5.2: Creating an Account*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#52-creating-an-account)*.*
- Install OpenSSL on your Windows Server.

## 5.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 5.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 5.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 5.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(52).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 5.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(50).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#53-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 5.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#54-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 5.6: Generating the Certificate*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#56-generating-the-certificate) as the value of Common Name (CN) to generate a self-signed certificate and a private key.

### 5.6 Generating the Client Certificate

Perform the following steps to generate a self-signed certificate or CA certificate such that the CN contains the app UUID:

Run the following command to generate a client certificate using OpenSSL:

```bash
openssl req -newkey rsa:2048 -nodes -keyout mongotest.key -x509 -days 365 -out mongotest.pem
```

The system will prompt you to enter `Country Name`, `State or Provinence Name`, `Locality Name`, and so on.

It will also prompt you to enter the Common Name. Enter the app UUID as copied in [*Section 5.5: Copying the App UUID*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#55-copying-the-app-uuid) as the value for the CN.

![Fig4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378419412244.png)

**Figure 4: Generate certificate**

### 5.7 Updating the Authentication Method

Perform the following steps to change the authentication method:

1. Go to the detailed view of the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-mongodb-encryption-at-rest-windows#54-creating-an-application) and then click **Change authentication method** and select **Certificate** to change the authentication method to Certificate.
2. Click **SAVE**.
3. On the **Add certificat**e dialog box, click **UPLOAD NEW CERTIFICATE** to upload the certificate file `mongotest.pem` or paste the content of the certificate generated in previous section.
4. Select both check boxes to confirm your understanding of the action.
5. Click **UPDATE** to save the changes.

## 6.0 Configure Encryption in MongoDB Windows

Perform the following steps:

1. Run the following command to convert the certificate in PFX Format.

```bash
openssl pkcs12 -export -out mongotest.pfx -inkey mongotest.key -in mongotest.pem
```

![Fig6.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378401747988.png)

**Figure 5: Convert certificate to PFX**
2. Copy the `mongotest.pfx` file to the Windows Server machine where MongoDB is installed.
3. Run the following command to import the `mongotest.pfx` file to the Windows Server to the trusted store:

```bash
certutil.exe -importpfx -f -p  <Password for the PFX>.\ mongotest.pfx
```

Where, `mongotest.pfx` is the PFX file.

![Fig7.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378401750036.png)

**Figure 6: Import PFX file to windows server**
4. Run the following command to import the root certificate for the Fortanix DSM to the Windows Certificate Trust:

```bash
certutil.exe -addstore -f Root .\RootCA.pem
```

![Fig8.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378419432980.png)

**Figure 7: Import root certificate**
5. After the certificate is imported, open the **Windows Certificate Store** and go to **Personal** → **Certificates**. You will find the certificate imported above.

![Fig9.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378419437972.png)

**Figure 8: Certificate imported**
6. Click the certificate and go to the details. You will find the thumbprint of the certificate.

![Fig10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378401757332.png)

**Figure 9: Certificate thumbprint**
7. Capture the thumbprint and run the following command from MongoDB:

```bash
mongod --enableEncryption --kmipServerName integrationtest.eastus.cloudapp.azure.com --kmipPort 5696 --kmipClientCertificateSelector thumbprint=aobe20e64bcf04a674676f122h6g876 --dbpath D:\DBA
```

**Output:**

![Fig11.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/24378401761556.png)

**Figure 10: Certificate thumbprint**

You can add `-vvvvv` at the end of the command to run the same command in debug mode.
8. This will create a Security-object in Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768853439089.png)

**Figure 11: Security object created**
9. Verify the key operations using the Activity Logs.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768853450310.png)

**Figure 12: Activity loss for key operations**

## 7.0 Mongo Master Key Rotation

Perform the following steps:

1. Run the following command to process key rotation within MongoDB:

```bash
mongod --enableEncryption --kmipServerName integrationtest.eastus.cloudapp.azure.com --kmipPort 5696 --kmipClientCertificateSelector thumbprint=28885b9c95b999b342da9ba9f4ac9bcdffa0e52b --dbpath D:\DBA –kmipRotateMasterKey
```
2. After the command runs successfully a key would be created within Fortanix DSM:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768853462016.png)

**Figure 13: Key rotation**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.

## Related

- [Fortanix DSM as a KMS to Secure VMware Virtual Environments](/fortanix-dsm-as-a-kms-to-secure-vmware-virtual-environments.md)
- [Fortanix DSM for MongoDB Encryption at Rest - Linux](/fortanix-dsm-for-mongodb-encryption-at-rest-linux.md)