---
title: "Fortanix DSM with Oracle Key Vault"
slug: "fortanix-dsm-with-oracle-key-vault"
updated: 2026-08-19T14:12:11Z
published: 2026-08-19T14:12:11Z
canonical: "support.fortanix.com/fortanix-dsm-with-oracle-key-vault"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Oracle Key Vault

## 1.0 Introduction

This article describes the steps to integrate **Fortanix-Data-Security-Manager (DSM)** with **Oracle Key Vault (OKV)**.

The Oracle Key Vault (OKV) uses an Oracle Database to store the client/endpoint keys. This Oracle DB repository inside OKV uses Transparent Data Encryption (TDE) and the TDE master key is stored in a local file wallet on the OKV server. In a standard OKV configuration, the OKV TDE key is stored inside a password-protected wallet. With Fortanix HSM integration, the OKV wallet password will be encrypted using a key that will be stored in Fortanix HSM as a root of trust.

## 2.0 Prerequisites

Ensure the following:

- Fortanix DSM minimum version - 4.2
- Fortanix PKCS#11 library
- Oracle Key Vault 21.3
- Oracle Key Vault should be able to reach Fortanix DSM

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_App(6).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-data-security-manager-with-oracle-key-vault#33-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-data-security-manager-with-oracle-key-vault#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. Click the **USERNAME/PASSWORD** tab.
4. From the **Credentials Details** dialog box, copy the **Username (app UUID)** and **Password** as it will be used in the PKCS#11 configuration file.

## 4.0 Create Fortanix Directories

Perform the following steps to create the Fortanix DSM directories:

1. Log in to Oracle Key Vault Server and switch to the root directory.
2. Run the following command to create a directory structures under `/opt`:

```bash
mkdir -p /opt/fortanix/bin /opt/fortanix/conf /opt/fortanix/log
```

> [!NOTE]
> NOTE
> 
> Oracle recommends creating the client installation directory in a new subdirectory under `/opt`.

## 5.0 Change the Ownership and Permissions

Run the following commands to change the ownership and permissions of the Fortanix DSM client installation directories:

```bash
chown -R oracle:oinstall /opt/fortanix
chmod -R 755 oracle:oinstall
```

## 6.0 Upload Fortanix PKCS#11 Library

Perform the following steps to download Fortanix PKCS#11 library and then upload it to OKV server:

1. Download and install the Fortanix PKCS#11 library. *For more information, refer to* [*Clients: PKCS#11 Library*](/v1/docs/clients-pkcs11-library)*.*
2. Upload the Fortanix PKCS#11 library to `/opt/fortanix/bin` location in the OKV server.
3. Rename the library to `libpkcs11.so`.

## 7.0 Create PKCS#11 Configuration File

Create the `pkcs11.conf` file in the `/opt/fortanix/conf` folder with the following parameters:

```bash
api_endpoint = "https://sdkms.fortanix.com"
app_id="<Fortanix_DSM_APP_ID>"
prevent_duplicate_opaque_objects = true
retry_timeout_millis = 60000

[log]
file = "/opt/fortanix/log/pkcs11.log"
```

## 8.0 Modify HSM Configuration Parameters

Modify `okv_hsm.conf` parameters and add the parameters as below:

```bash
cd /usr/local/okv/hsm/generic
In okv_hsm.conf add the below paths 
VENDOR_NAME="Fortanix"
PKCS11_LIB_LOC= “/opt/fortanix/bin/libpkcs11.so”
PRESEVED_FILES=”/opt/fortanix/bin:/opt/fortanix/conf:/opt/fortanix/conf/pkcs11.conf: /opt/fortanix/bin/libpkcs11.so”
```

## 9.0 Add Environment Variable

Add the following environment variable in `okv_hsm_env` file under `/usr/local/okv/hsm/generic`:

```bash
FORTANIX_PKCS11_CONFIG_PATH=”/opt/fortanix/conf/pkcs11.conf”
```

## 10.0 Verify Fortanix DSM Endpoint Connectivity

Perform the following steps to verify that the Fortanix DSM endpoint is reachable from the OKV server:

1. Run the following curl command to verify the SSL certificate:

```bash
curl -v <endpoint_url>
```

> [!NOTE]
> NOTE
> 
> If the SSL verification is failing, you should upload the endpoint rootCA certificate to `/opt/fortanix/conf` directory and add the following parameter to the `pkcs11.conf` file.
> 
> ```bash
> ca_certs_file = "/opt/fortanix/conf/rootCA.pem"
> ```
2. Run the following command to verify the certificate check:

```bash
curl --cacert /opt/fortanix/conf/rootCA.pem <endpoint_url> -v
```

## 11.0 Initialize HSM

For the rest of the activity, use the OKV user interface (UI) console.

1. Log in to Oracle Key Vault SYSADMIN.
2. Go to the **System** tab and click **Hardware Security Module**.
3. Click **Initialize** to initialize the HSM and enter the **HSM Credential** and OKV **Recovery Passphrase**.

![Initialize_HSM_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456569388948.png)

**Figure 4: Initialize HSM**
  - **HSM Credential**: `APP_PASSWORD`
  - **Re-enter HSM Credential**: `APP_PASSWORD`
  - **Recovery Password**: `&lt;the OKV recovery password&gt;`
4. The HSM is initialized.

![Initialized_HSM_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456605873044.png)

**Figure 5: HSM initialized**

## 12.0 Set HSM Credentials

1. If you want to change the `APP_CREDENTIALS` (HSM credentials) at any point, you can follow the process below:
  1. Change the secret size and regenerate the App password by clicking **REGENERATE**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Oracle_Key_Vault_Regenerate.png)

**Figure 6: Regeneratre API key**
2. Click **Set Credential** on **OKV SYSADMIN** → **Hardware Security Module**. This will pop up a prompt asking to fill the new password.

![SetCredential_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456670301716.png)

**Figure 7: Set credential**
  - **HSM Credential**: `&lt;New APP_ID&gt;`
  - **Re-enter HSM Credential**: `&lt;New APP_ID&gt;`

## 13.0 Reverse Migration of HSM

At times when you need to revert the Fortanix DSM integration for some reason, you can perform the following procedure:

![SetCredential_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456670301716.png)

**Figure 8: HSM reverse migration**

Where,

- **HSM Credential:** `&lt;APP_PASSWORD&gt;`
- **Old Recovery Passphrase:** `&lt;OKV Recovery Passphrase&gt;`
- **New Recovery Passphrase:** `&lt;New OKV Recovery Passphrase&gt;`
- **Re-enter New Recovery Passphrase:** `&lt;New OKV Recovery Passphrase&gt;`

After successful reverse migration, check the status as below:

![ReverseMigrateStatus_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456867516308.png)

**Figure 9: Reverse migration complete**

## 14.0 OKV Backup and Restoration

Perform the following steps to back and restore the OKV with root of trust in Fortanix DSM:

1. Manage the backup location to a remote server.
2. Take a backup.

> [!NOTE]
> NOTE
> 
> Ensure the HSM integration status is green (enabled) before taking the backup.
3. Install and configure a fresh OKV instance.
4. Follow all the process as described in [*Section 4.0: Create Fortanix Directories*](/v1/docs/using-data-security-manager-with-oracle-key-vault#40-create-fortanix-directories) *to* [*Section 11.0: Initialize HSM*](/v1/docs/using-data-security-manager-with-oracle-key-vault#110-initialize-hsm) and ensure that Fortanix DSM integration prerequisites are configured.
5. Configure the manage backup location to the same remote server where backup files are available, taken in *Step 2*.
6. Set the HSM credentials and restore the backup on the new instance of OKV.

![AvailableBackup_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456945109780.png)

**Figure 10: Available backups**

![RestoreDetails_OKV.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456965922452.png)

**Figure 11: Restore details**

![OKVRestored.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/12456982995476.png)

**Figure 12: OKV restored**

*For more information, refer to Section 2.4.2 in* [*Oracle Key Vault Backup and Restoration*](https://docs.oracle.com/en/database/oracle/key-vault/21.3/okvhm/configuring-hsm-oracle-key-vault1.html#GUID-353DA645-AFB9-4800-89B5-E77D8B73F9C6)*.*

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.