---
title: "Fortanix DSM with CyberArk Certificate Manager, Self Hosted - Keyless TLS"
slug: "fortanix-dsm-with-venafi-keyless-tls"
updated: 2026-07-27T16:06:02Z
published: 2026-07-27T16:06:02Z
canonical: "support.fortanix.com/fortanix-dsm-with-venafi-keyless-tls"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with CyberArk Certificate Manager, Self Hosted - Keyless TLS

## 1.0 Introduction

This article outlines the process of integrating **Fortanix-Data-Security-Manager (DSM)** with **CyberArk using Keyless TLS** instead of an HSM. The integration details the steps to incorporate Fortanix as a Keyless TLS connector within CyberArk.

## 2.0 Prerequisites

Ensure the following:

- Install the Fortanix CNG/EKM provider from [*here*](https://fortanix.zendesk.com/hc/en-us/sections/27488968118932-CNG-EKM).
- Install VCert CLI from CyberArk. *For more information, refer to* [*VCert CLI for CyberArk Certificate Manager, Self-Hosted*](https://github.com/Venafi/vcert/blob/master/README-CLI-PLATFORM.md) *or* [*VCert CLI for CyberArk as a Service*](https://github.com/Venafi/vcert/blob/master/README-CLI-CLOUD.md) *to get started with the command line utility.*
- Configure the CyberArk account with a Security Principal in CyberArk for interacting with VCert/API.

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(42).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(41).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-venafi-keyless-tls#33-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-venafi-keyless-tls#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to use it later.

## 4.0 Install the Fortanix DSM Client on Web Server

> [!NOTE]
> NOTE
> 
> The following steps need to be completed on each web server. Any node should be able to communicate with Fortanix DSM and authenticate using the API key generated in the previous section.

1. Install the Fortanix DSM CNG client software:
  1. Download the MSI from [*CNG EKM*](https://fortanix.zendesk.com/hc/en-us/sections/27488968118932-CNG-EKM)*.*
  2. Run the MSI package and accept the default values.
2. Configure the Fortanix DSM CNG client:
  1. Navigate to the Fortanix default client `C:\Program Files\Fortanix\KMSClient` directory.
  2. Run the following commands to configure the Fortanix DSM client:

```bash
FortanixKmsClientConfig.exe user --api-endpoint [Fortanix DSM URL]
FortanixKmsClientConfig.exe user
```

```bash
  --api-key
```
  3. An example of the Fortanix DSM URL is: *https://amer.smartkey.io*

*For more information, refer to* [*Clients: Microsoft CNG Key Storage Provider*](/v1/docs/clients-microsoft-cng-key-storage-provider).

## 5.0 Configure the Script

Before running the CyberArk script, perform the following steps to configure the script:

1. CyberArk VCert is a command-line tool designed to generate keys and simplify certificate acquisition, eliminating the need to write code required to interact with the CyberArk REST API. Perform either of the following two methods:
  1. Refer to [*https://github.com/CyberArk/vcert/blob/master/README-CLI-PLATFORM.md*](https://github.com/Venafi/vcert/blob/master/README-CLI-PLATFORM.md) to download the VCert for CyberArk Certificate Manager, Self-Hosted. Log in to theCyberArk Certificate Manager, Self-Hosted node using the service account assigned to CyberArk. OR
  2. Refer to [*https://github.com/CyberArk/vcert/blob/master/README-CLI-CLOUD.md*](https://github.com/Venafi/vcert/blob/master/README-CLI-CLOUD.md) to download the CyberArk CLI if you are using CyberArk as a service.
2. Set up the Headers and Body in the CyberArk script for authenticating to CyberArk. Refer to the Readme file in the package.
3. On a Windows Web Server that has IIS installed, use `Vcert` to upload a Certificate Signing Request (CSR).
4. You must create a `.txt` configuration file with the following parameters to modify the values as per your environment.

> [!NOTE]
> NOTE
> 
> - This `.txt` configuration file must be available in the same directory as the CyberArk script file.
> - Ensure that the backslashes are doubled to avoid errors.

```bash
{
"CyberArk": 
  { 
      "URL":"https://cyberark-certificate-manager-self-hosted.company.com", 
      "VCertPath":"c:\\temp", 
      "Policy":"\\VED\\Policy\\Certificates\\IIS" 
  },
"IIS":  
  { 
      "KeySize":"2048", 
      "DistinguishedName":" CN=example.com,O=Company,OU=TeamName,L=City,ST=State,C=US", 
      "FriendlyName":"certname" 
  }
}
```

Where,
  - `URL` refers to the base URL for CyberArk Certificate Manager, Self-Hosted.
  - `VCertPath` refers to the location of VCert binary.
  - `Policy` refers to the destination policy for the newly created certificate.
  - `KeySize` refers to the size of the RSA keys to be generated up to 8K.
  - `DistinguishedName` refers to the complete Distinguished Name (DN) string for the new certificate. The CyberArk policy should be set to allow variance in the individual elements.
  - `FriendlyName` refers to associated to the certificate as it exists in CertManager and is referenced by IIS. This value must be unique.

## 6.0 Fortanix DSM with CyberArk Workflow

The following image illustrates keyless TLS with IIS.

![Screenshot](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Venafi_TLS_Architecture.png)

**Figure 4: CyberArk workflow**

The script performs the following steps:

1. It fetches credentials (Username and Password) for CyberArk Certificate Manager, Self-Hosted, from the user.
2. It looks for the `.txt` configuration file that you created above in [*Section 5.0: Configuring the Script*](/v1/docs/using-fortanix-data-security-manager-with-venafi-keyless-tls#50-configuring-the-script). If found, it imports the values such as URL, certificate path, and policy from the configuration file, otherwise, it displays a message “config file not found”. An example is attached in the PowerShell script package.
3. It looks for the Fortanix CNG provider client that you installed in [*Section 4.0: Installing Fortanix DSM Client on Web Server*](/v1/docs/using-fortanix-data-security-manager-with-venafi-keyless-tls#40-installing-fortanix-dsm-client-on-web-server). This is one of the prerequisites based on its default location.
4. Looks for the Vcert binary and verifies the location (`VCert.exe`) based on the `.txt` configuration file value.
5. Checks whether the same `FriendlyName` has been used previously. `FriendlyName` configured in the `.txt` configuration file should be unique in the Windows certificate store. If `FriendlyName` has already been used, the CyberArk script will exit here.
6. It makes the API call (`/authorize/oauth`) to authenticate to CyberArk and fetch a session token.
7. After successful authentication, the script will create the configuration file (`.inf` file) for `certutil.exe`.
8. `certutil` is invoked to create the key pair, and CNG configuration ensures that the private key is generated on the HSM and does not leave. The output from this step is a Certificate Signing Request.
9. Invoke `Vcert.exe` to upload the CSR to CyberArk - CyberArk will issue the certificate based on CyberArk policy configuration.

Perform the following steps to verify the integration:

1. Using `FriendlyName` from the `.txt` configuration file, find the thumbprint of the certificate from the certificate store.
2. Update the IIS binding by entering the valid IIS site ID.
  - If the entered Site ID is greater than 1, ask the user to identify a site for an update.
  - If the entered site ID is less than 1, then alert and exit.
  - If the entered site ID is equal to 1, the default website will be selected.
3. Restart IIS and verify the certificates.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.