Getting Started with External Key Source Connection

1. On the Select External KMS Type step, select the External Key Source Connections type and the Fortanix DSM (SaaS) provider.

2. Click NEXT.

NOTE

You can also add a Fortanix DSM (SaaS) connection by clicking ADD EXTERNAL KEY SOURCE in the top-right corner of the EXTERNAL KEY SOURCE tab on the Connections page.

5.3 Add Fortanix DSM (SaaS) Connection

Perform the following steps to add a Fortanix DSM (SaaS) connection on the Add DSM (SaaS) Connection step:

1. Connection name: Enter a name for your Fortanix DSM  (SaaS) connection.

2. Region: Select the required region from the drop down. For example, North America. For the list of all supported regions, refer to Fortanix DSM SaaS Global Availability Map.

3. This will create a DSM Connection. The connection can be deleted later from the connections screen: Select the check box to confirm that a Fortanix DSM SaaS connection will be created. The connection appears under the EXTERNAL KEY SOURCE tab on the Connections page, but it will not yet be integrated with Fortanix DSM.

4. Click ADD CONNECTION & PROCEED.

5.4 Add Admin App UUID

Perform the following steps to configure the private key and certificate on the Add Admin App UUID step:

1. Click GENERATE PRIVATE KEY to create a private key. You can generate a maximum of two private keys.

   • Click GENERATE ANOTHER PRIVATE KEY to generate an additional key.

   • You can delete the private key using .

2. Click GENERATE CERTIFICATE to generate a self-signed certificate. This button will only be enabled after generating a private key.

   • You can copy the generated certificate details.

   • You can also RE-GENERATE THE CERTIFICATE, if required.

3. After generating and downloading the certificate,

   1. Log in to your Fortanix Data Security Manager account in the same region selected in Step 2 of Section 5.3: Add Fortanix DSM (SaaS) Connection above to ensure proper correlation.

   2. Create an administrative (admin) app using the steps mentioned in Create Admin Apps, selecting Certificate as the authentication method, and uploading the certificate generated in Step 2.

   3. After creating the admin app, copy the UUID value.

4. Admin app UUID: Enter the value obtained from Fortanix DSM (SaaS) admin app.

   NOTE

   It is recommended to use a unique Fortanix DSM admin app UUID for each Fortanix DSM (SaaS) connection in Fortanix Key Insight to prevent performance degradation and reduce unnecessary clutter.

5. Click CONNECT to establish the connection between Fortanix DSM (SaaS) and Fortanix Key Insight. If your credentials (region and certificate) are incorrect, an error message appears. Ensure you use the correct credentials to establish the connection with Fortanix DSM (SaaS).

1. On the Select External KMS Type step, select External Key Source Connections type and the Fortanix DSM (On-Premises) provider.

2. Click NEXT.

NOTE

You can also add a Fortanix DSM (On-premises) connection by clicking ADD EXTERNAL KEY SOURCE in the top-right corner of the EXTERNAL KEY SOURCE tab on the Connections page.

6.3 Add Fortanix DSM (On-premises) Connection

Perform the following steps to add a Fortanix DSM (On-premises) connection on the Add DSM (On-Premises) Connection step:

1. Connection name: Enter a name for your Fortanix DSM (On-premises) connection.

2. This will create a DSM Connection. The connection can be deleted later from the connections screen: Select the check box to confirm that a Fortanix DSM SaaS connection will be created. The connection appears under the EXTERNAL KEY SOURCE tab on the Connections page, but it will not yet be integrated with Fortanix DSM.

3. Click Fortanix on-premises scanner package to download the Fortanix On-premises Scanner for Fortanix DSM on-premises connection.

   1. After downloading the package, install it depending on your operating system (Linux or Windows).

      • For instructions on how to install the Fortanix On-Premises Scanner package on Linux, refer to On-premises Scanner Configuration - Linux.

      • For instructions on how to install the Fortanix On-Premises Scanner package on Windows, refer to On-premises Scanner Configuration - Windows.

   2. After installing the package, configure the Fortanix DSM on-premises connection using the configuration file.

      For information on Fortanix DSM On-premises connection configuration file parameters, refer to On-premises Scanner Configuration File.

   3. After configuration, execute the Fortanix On-premises Scanner package depending on your operating system (Linux or Windows).

      • For instructions on how to execute the Fortanix On-Premises Scanner package on Linux, refer to On-premises Scanner Configuration - Linux.

      • For instructions on how to install the Fortanix On-Premises Scanner package on Windows, refer to On-premises Scanner Configuration - Windows.

4. After installation and configuration of the package, select any of the following:

   1. ADD DSM: Select this option if you have not enabled the I have downloaded and installed the Scanner package check box. The connection will be added under the EXTERNAL KEY SOURCE tab on the Connections page, though it will not yet be integrated with Fortanix DSM.

      Perform the following steps:

      1. Select I have downloaded and installed the Scanner package check box to confirm the scanner installation.

      2. Click GENERATE API KEY to add the scanner using the generated API key.

      3. In the API Key Details dialog box, click COPY API KEY to copy the API key value.

      4. Close the dialog box to complete the onboarding.

   2. ADD DSM & GENERATE API KEY: Select this option if you have enabled the I have downloaded and installed the Scanner package check box to add the scanner using the generated API key. You will be authenticating with Fortanix Key Insight using the API keys.

      Perform the following steps:

      1. In the API Key Details dialog box, click COPY API KEY to copy the API key value. This value is used to authenticate both the Fortanix On-premises Scanner and Fortanix Key Insight.

      2. Close the dialog box to complete the onboarding.

NOTE

After onboarding the Fortanix DSM (On-premises) connection,

• You can verify the connection status from the Connections page under the EXTERNAL KEY SOURCE tab.

  • If the status is Connected, you can access the Overview and Keys pages. For more information on the UI, refer to External Key Source Connection - User Interface Components.

  • If the status is Disconnected, restart the scanner to re-establish the connection.

  • If the status is Pending, use the generated API key to connect to Fortanix Key Insight. After the connection is established, add the resources to begin scanning.

• Users with the Account Administrator and Group Administrator roles can manage (edit, delete, rescan, and view details) the connection from the Connections page under the EXTERNAL KEY SOURCE tab.

  • If you edit the Fortanix DSM (On-premises) connection, rescan both the Fortanix DSM (On-premises) connection and its associated parent connection (if any) to apply the changes.

  • Deleting the Fortanix DSM (On-premises) connection cannot be undone.

  • The Rescan option is available only when the Fortanix DSM (On-premises) connection status is Connected.

    • After rescanning the Fortanix DSM (On-premises) connection, manually rescan the linked Fortanix Key Insight cloud or on-premises connection (if any) to update the correlated key data.

  • When viewing the connection details:

    • Copy the Connection ID. This value is required in the Fortanix On-premises Scanner configuration.

    • Click MANAGE API KEY to manage (copy, delete, regenerate) the API key geneated.

      • You can generate a maximum of two API keys for configuring the connection between Fortanix DSM (On-premises) and Fortanix Key Insight.

      • Deleting an API key may revoke access for the Fortanix DSM (On-premises) connection, potentially disrupting its functionality. This action is irreversible.

    • Click DOWNLOAD PACKAGE to download the package again in case you changed your machine, your current package has errors or was not installed correctly.

    

• You can switch the region at any time using the region switcher drop down located on the top navigation bar of the connection UI. When the region is changed, the UI updates automatically to show the data, connections, and scan results for that region.

• A group with the same name will be created on the Fortanix IAM Groups page. For more information on Groups, refer to Fortanix Armor Identity and Access Management-IAM.