---
title: "Fortanix DSM with NetApp ONTAP"
slug: "fortanix-dsm-with-netapp-ontap"
updated: 2026-07-08T17:59:54Z
published: 2026-07-08T17:59:54Z
canonical: "support.fortanix.com/fortanix-dsm-with-netapp-ontap"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with NetApp ONTAP

## 1.0 Introduction

This article describes the process of integrating **Fortanix-Data-Security-Manager (DSM)** with **NetApp ONTAP** to centrally manage keys for the Volume Encryption feature of ONTAP. By utilizing Fortanix DSM, organizations can achieve centralized management and control of all cryptographic keys, ensuring robust security practices.

The document provides essential information for:

- Creating a KMIP (Key Management Interoperability Protocol) application on Fortanix DSM.
- Configuring NetApp ONTAP to use external key management.
- Implementing Volume Encryption using a Fortanix DSM-based key with NetApp ONTAP.
- Viewing and managing encryption keys on Fortanix DSM.

## 2.0 Product Tested Version

The following product versions were tested:

- Fortanix DSM version 4.27 patch 2 or later.
- Fortanix DSM version 4.31 or later.
- Fortanix DSM version 5.6.
- NetApp ONTAP version 9.15.1 patch 17 (9.15.1P17).

## 3.0 Prerequisites

Ensure the following:

- NetApp OnTap version 9 is installed on the system.
- Fortanix DSM cluster is running a tested version.

## 4.0 Architecture Workflow

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/NetAppOnTAP-Arch.png)

**Figure 1: Architecture diagram**

This architecture diagram illustrates the integration of NetApp ONTAP and Fortanix DSM using the Key Management Interoperability Protocol (KMIP) for secure encryption key management.

NetApp ONTAP encrypts stored data, while Fortanix DSM securely manages encryption keys separately. Instead of storing keys within the storage system, NetApp ONTAP communicates with Fortanix DSM over KMIP to retrieve encryption keys when needed, ensuring access is restricted to authorized users.

KMIP plays a crucial role in this integration by standardizing key management communication between NetApp ONTAP and Fortanix DSM. This protocol ensures seamless and secure key retrieval, rotation, and management without manual intervention.

Fortanix DSM enforces authentication for users, applications, and systems before granting access to encryption keys, preventing unauthorized decryption. Even if NetApp ONTAP storage is compromised, the encrypted data remains secure since the keys are centrally managed within DSM through KMIP, maintaining strong access control and compliance with security standards.

## 5.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 5.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 5.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 2: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 5.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(20).png)

**Figure 3: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 5.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(19).png)

**Figure 4: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#53-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 5.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#54-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 5.6: Generating a Certificate*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#56-generating-a-certificate).

### 5.6 Generating a Certificate

A certificate must be generated to identify the application through which KMIP keys will be generated and retrieved by ONTAP.

Two methods are available for generating this certificate:

#### 5.6.1 Creating a CSR for Certificate Issuance from a Trusted CA (Production Environment)

Perform the following steps to create a Certificate Signing Request (CSR) for certificate issuance from a Trusted Certificate Authority (CA):

1. Use the following command to create a CSR:

```bash
openssl req -out kmip.req -new -newkey rsa:2048 -nodes -keyout key.pem
```
2. Fill out the certificate request fields according to your organization's standards. Ensure that the Common Name (CN) field is set to the Fortanxi DSM app UUID as copied in [*Section 5.5: Copying the App UUID*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#55-copying-the-app-uuid)*.*
3. Submit the `kmip.req` file to your local Certificate Authority (CA) for issuance.
4. Download the issued certificate as `cert.pem` from the CA, ensuring it is stored in PEM format.
5. Obtain copies of the Root CA and Intermediate CA certificates in PEM format. Save them in file `Fortanix_DSM_CA.cer`.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/NetApp_Commands.png)

**Figure 5: Example command for certificate request**

#### 5.6.2 Creating Self-Signed Certificate (Lab Environment)

Run the following command to generate a self-signed certificate:

```bash
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN= {Fortanix DSM App UUID}"
```

Replace the `{Fortanix DSM app UUID}` with the actual app UUID copied in [*Section 5.5: Copying the App UUID*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#55-copying-the-app-uuid)*.*

### 5.7 Updating the Authentication Method

Perform the following steps to change the authentication method:

1. Go to the detailed view of the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#54-creating-an-application) and click **Change authentication method** and select the **Certificate** option to change the authentication method to Certificate.
2. Click **SAVE**.
3. On the **Add certificate** dialog box, click **UPLOAD NEW CERTIFICATE** to upload the certificate file or paste the content of the `cert.pem` certificate generated in [*Section 5.6: Generating a Certificate*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#56-generating-a-certificate).
4. Select both check boxes to confirm your understanding of the action.
5. Click **UPDATE** to save the changes.

## 6.0 Configuration on NetApp ONTAP

The following section describes the procedures to add a Key Management Server (KMS) and to set up volume encryption to enhance the security of your data storage environment:

### 6.1 Adding Key Management Server

Perform the following steps to add a Key Management Server (KMS) to NetApp ONTAP:

1. Run the following command to update the certificate and key for the client:

```bash
security certificate install -type client
```

Copy and paste the output of the certificate and key generated in [*Section 5.6: Generating a Certificate*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#56-generating-a-certificate) when prompted.
2. When asked, `Do you want to continue entering root and/or intermediate certificates?`, type `n`:

```bash
Do you want to continue entering root and/or intermediate certificates: n
```
3. If your Issuing CA for the KMIP certificate is a public CA that is kept current with ca-certificates, then proceed to *Step 6*.
4. Open the Fortanix DSM root CA certificate, `Fortanix_DSM_CA.cer`, saved previously with a text editor and copy the certificate value.
5. Run the following command to update the certificate and key for the server:

```bash
security certificate install -type server-ca
```

Paste the output of the certificate from *Step 4* when prompted.
6. Run the following command to confirm the name of the Imported Client and Server-CA Certificates:

```bash
security certificate show-user-installed
```

![NetApp_ConfirmName.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4411510534036.png)

**Figure 6: Confirm name of imported certificate**
7. Run the following command to enable the External Key Servers (EKS):

```bash
security key-manager external enable -key-servers {Fortanix DSM FQDN}:5696 -client-cert {Client
Certificate Name} -server-ca-certs {Server CA Certificate Name}
```

For example,

```bash
security key-manager external enable -key-servers <fortanix_dsm_url>:5696 -client-cert 76ddf566-
c4f0-4c62-b711-c944cd4cfbc0 -server-ca-certs DSTRootCAX3
```
8. Run the following command to verify the status of the External Key Manager (EKM):

```bash
security key-manager external show-status
```

![NetApp_KMStatus.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4411496228372.png)

**Figure 7: Key manager status**

### 6.2 Enabling Volume Encryption

Perform the following steps to configure the volume encryption on NetApp ONTAP:

1. Open an SSH client and connect to the set node IP address.
2. Run the following command to set the diagnostic mode:

```bash
set diag
```

Type `Y` to continue, when prompted.

```bash
Do you want to continue? Y
```
3. Run the following commands to configure the diagnostic aggregate:

```bash
storage aggregate create -aggregate {test aggregate name} -node {NetApp Node Name} -diskcount 5
-encrypt-with-aggr-key false
```

Type `Y` to continue, when prompted.

```bash
Do you want to continue? Y
```
4. Run the following command to create a server:

```bash
vserver create -vserver {test vserver name} -aggregate {aggregate name from step 3} -rootvolumesecurity-
style mixed
```
5. Run the following command to create an encrypted volume:

```bash
volume create -vserver {vserver name from step 4} -aggregate {aggregate name from step 3} -
encrypt true -size 20Mb -volume {test volume name}
```
6. Run the following command to check the state of the vserver:

```bash
volume show -is-encrypted true -state online
```

![NetApp_vserverState.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4411510587028.png)

**Figure 8: Vserver state**
7. Run the following command to query the key status:

```bash
security key-manager key query
```

![NetApp_KeyStatus.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4411496228116.png)

**Figure 9: Key status**

## 7.0 Verify the Activity Logs

Perform the following steps to view the keys in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-netapp-ontap#54-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. In the **INFO** tab, view the Activity Logs on the app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Ontap-Audit-Log(1).png)

**Figure 10: View activity logs**
3. Go to the **Security Objects** tab and view the list of the keys.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/NetApp_ONTAP_App_SO(1).png)

**Figure 11: View keys in DSM**

## 8.0 Migrate ONTAP Encryption Keys

For instructions on migrating the **NetApp ONTAP** encryption keys, contact NetApp Support.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM with Commvault](/fortanix-dsm-with-commvault.md)
- [Logging](/fortanix-dsm-logging.md)
- [How to configure trusted CA to outside parties](/fortanix-ccm-how-to-configure-trusted-ca-to-outside-parties.md)
- [Installation from Azure Marketplace](/fortanix-data-security-manager-installation-from-azure-marketplace.md)
- [Fortanix DSM with Oracle TDE](/using-fortanix-dsm-with-oracle-tde.md)