---
title: "Fortanix CCM - Quickstart"
slug: "quickstart-guide-1"
updated: 2026-06-26T16:25:32Z
published: 2026-06-26T16:25:32Z
canonical: "support.fortanix.com/quickstart-guide-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix CCM - Quickstart

## 1.0 Introduction

This article describes how to deploy and run applications using Fortanix Confidential Computing Manager (CCM) Software as a Service (SaaS).

Fortanix CCM enables an application to run in a confidential computing environment. The solution orchestrates critical security policies such as identity verification, data access control, and code attestation for enclaves that are required for confidential computing.

It also contains the information related to:

- Signing up and logging in to Fortanix CCM
- Creating and selecting an account
- Creating a group to organize resources
- Adding an application
- Creating and approving an application image
- Enrolling compute node agents
- Running the application on enrolled compute nodes

## 2.0 Prerequisites

Ensure the following:

- A private Docker registry to push converted application image(s).
- An Azure Portal subscription account.

## 3.0 Getting Started with Fortanix CCM

### 3.1 Sign Up and Log In

Perform the following steps to access Fortanix CCM:

1. Visit [*https://ccm.fortanix.com*](https://ccm.fortanix.com) and sign up.
2. After your account is approved by the Administrator, log in by entering your email address and password.

![CCM_5.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360078176211.png)

**Figure 1: Logging in**

### 3.2 Create and Select an Account

Perform the following steps to create and select an account in Fortanix CCM:

1. Once you log in to your account, you will be taken to the **Accounts** page. Click **ADD ACCOUNT** to create a new account.
2. Enter a name for the new account and optionally add a custom logo for the account.
3. Click **CREATE ACCOUNT** to complete the account creation.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3428)(4).png)

**Figure 2: Create an account**
4. Once the account is created, click **SELECT ACCOUNT** to select the newly created account and start enrolling compute nodes and creating applications.

![Quickstart17.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1748882555790.png)

**Figure 3: Select an account**

### 3.3 Create a Group

Perform the following steps to create a group:

1. In the CCM left navigation panel, click the **Groups** menu item, and then click **+ ADD GROUP** to add a group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (2755).png)

**Figure 4: Add group**
2. In the **GROUP** dialog box:
  1. **Name**: Enter a required name for the group.
  2. **Labels** (Optional): Assign one or more key-value labels to the group.
3. Click **SAVE** to create a group.

The group is successfully created.

### 3.4 Add an Application

Perform the following steps to add an application:

1. In the CCM left navigation panel, click the **Applications** menu item, and then click **+ ADD APPLICATION** to add an application.

In this example, an Enclave OS application running a Python Flask server is used.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3255).png)

**Figure 5: Create an application**
2. In the **APPLICATION** dialog box, select **Enclave OS Application** and click **PROCEED**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3581)(2).png)

**Figure 6: Add an Enclave OS application**

> [!NOTE]
> NOTE
> 
> This article covers an example of running an Enclave OS application.
> 
> - *For more information on Enclave Development Platform (EDP) applications, refer to* [*Add EDP Application*](/v1/docs/bringing-edp-rust-apps-to-confidential-computing-manager-1)*.*
> - *For more information on Application Configuration Instance (ACI) applications, refer to* [*Add ACI Application*](/v1/docs/users-guide-add-and-edit-an-application-1#60-add-aci-application)*.*
> - *For more information on Intel TDX applications, refer to* [*Add Intel TDX Application*](/v1/docs/users-guide-add-and-edit-an-application-1#80-add-azure-confidential-virtual-machine-cvm-application)*.*
> - *For more information on Azure Confidential Virtual Machine (CVM) applications, refer to* [*Add Azure CVM Application*](/v1/docs/users-guide-add-and-edit-an-application-1#70-add-azure-confidential-virtual-machine-application)*.*
> - *For more information on Advanced Micro Devices (AMD) Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) application, refer to* [*Add AMD SEV-SNP Application*](/v1/docs/users-guide-add-and-edit-an-application-1#70-add-amd-sevsnp-application)*.*
3. On the **Application details** form, fill in the relevant details and click **SAVE**. You can use Fortanix's public Docker registry for the sample application (app). **Details:** Docker Hub: [*https://hub.docker.com/u/fortanix/*](https://hub.docker.com/u/fortanix) *Optional:* You can run the app with the following command:

```bash
sudo docker run fortanix/python-flask
```

> [!NOTE]
> NOTE
> 
> It is recommended to use your private docker registry to store the output image.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3177).png)

**Figure 7: Configure an application**

*For more information on how to configure an Enclave OS application, refer to* [*Add Enclave OS Application*](/v1/docs/users-guide-add-and-edit-an-application-1#40-add-enclave-os-application)*.*

### 3.5 Create an Image

A Fortanix CCM Image is a particular software release or a version of an application. Each image is associated with one enclave hash (MRENCLAVE).

Perform the following steps to create an image:

1. Once you create an Enclave OS application, the **Images** page appears.
2. Click **+ ADD IMAGE** to create an image for the Enclave OS application.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3182).png)

**Figure 8: Create an image**
3. On the **Image** form:
  1. **Tag**: Enter a tag for the image. Use **“latest”** if you want to use the latest image builds.
  2. **ADD REGISTRY CREDENTIALS**: Enter registry credentials for the **Output image name**. This is required to access the private Docker registry where the output image is pushed. Since the input image is stored in a public registry, credentials for the input image are not required.
    - If registry credentials are already configured on the **Settings** page of Fortanix CCM, then the **Use same credential as input image registry** check box is selected by default, and the registry details are populated automatically.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3183).png)

**Figure 9: Add saved registry credentials**
    - If no registry credentials are saved on the **Settings** page, manually enter the registry credentials for the **Output image name**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3223).png)

**Figure 10: Add registry credentials manually**
  3. For the **Image Type** as **AWS Nitro Enclaves**:
    - **Memory size**
    - **CPU count**: CPU count is the number of CPUs to dedicate to an enclave out of all the CPUs available to the host machine.
4. Click **SAVE** to create the image.

After successful image creation, Fortanix CCM displays a confirmation notification, and the application is listed on the **Applications** page.

*For more information, refer to the following articles:*

- *To add multiple image registries, refer to* [*Image Registry*](https://support.fortanix.com/v1/docs/users-guide-image-registry-1)
- *To create an EOS application image, refer to* [*Create an Image for Enclave OS Applications*](https://support.fortanix.com/docs/users-guide-create-an-image-1#30-create-an-image-for-enclave-os-applications)
- *To create an EDP application image, refer to* [*Create an Image for EDP Applications*](https://support.fortanix.com/docs/users-guide-create-an-image-1#40-create-an-image-for-edp-applications)
- *To create an ACI application image, refer to* [*Create an Image for ACI Application*](/v1/docs/users-guide-create-an-image-1#33-aci-applications)
- *To create an Intel TDX application image, refer to* [*Create an Image for Intel TDX Applications*](/v1/docs/deploy-confidential-vm-applications-on-intel-tdx-using-fortanix-1)
- *To create an Azure CVM application image, refer to* [*Create an Image for Azure CVM Applications*](https://support.fortanix.com/docs/users-guide-create-an-image-1#70-create-an-image-for-azure-cvm-applications)
- *To create an Advanced Micro Devices (AMD) Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) application image, refer to* [*Create an AMD SEV-SNP Applications*](/v1/docs/users-guide-create-an-image-1#34-amd-sevsnp-applications)

### 3.6 Application Image Approval

Perform the following steps to approve the application image:

1. On the **Tasks** page, click the **Build Whitelist for app: Python Application Server** task.
2. Click **APPROVE** to whitelist the image.

![approved-tab.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/21620754126740.png)

**Figure 11: Approve the application image**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Approve_Image.png)

**Figure 12: Approve the application image**

### 3.7 Enroll Compute Node Agent - SGX

Perform the following steps to enroll the Fortanix CCM node agent:

1. In the CCM left navigation panel, click **Infrastructure** → **Compute Nodes**, and then click **+ ADD NODE** for **INTEL SGX**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3612).png)

**Figure 13: Add Compute node - Intel SGX**
2. In the **ENROL COMPUTE NODE** dialog box, click **COPY** to copy the **Join Token**. This token is used by the compute node to authenticate itself.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3611)(1).png)

**Figure 13: Copy the generated join token**
3. Go to [*Fortanix Confidential Computing Node Agent*](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/fortanix.rte_node_agent) create the Node Agent Virtual Machine (VM) and register the compute node.

> [!NOTE]
> NOTE
> 
> Alternatively, you can download the latest node agent software from [*Fortanix Node Agent*](https://fortanix.zendesk.com/hc/en-us/articles/360043407012-Fortanix-Node-Agent-Software-Intel-SGX-Platform) and install it on your own machine.
> 
> Ensure the Fortanix node agent software version for SGX is 4.9 or later.

![Quickstart10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360092020532.png)

**Figure 14: Create node agent in Azure**
4. Enter the required details to deploy the node agent on Azure. Paste the previously generated Join Token into the **Join Token** field.

> [!NOTE]
> NOTE
> 
> Information about supported regions and VM types is available [*here*](/v1/docs/supported-vms-for-azure-confidential-computing-1#regional-availability).

![Createnodeagent.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4414833976980.png)

![Createnodeagent1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4414833978260.png)

![Createnodeagent3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4414840761364.png)

**Figure 15: Configure the node agent**

![Createnodeagent4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4414833979412.png)

**Figure 16: Configuring the node agent**
5. After the node agent is created, the compute node is enrolled in Fortanix CCM and listed in the **Compute Nodes** overview table.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3613)(1).png)

**Figure 17: Node enrolled**

*For more information on how to enroll compute nodes, refer to* [*Supported Platforms*](https://support.fortanix.com/docs/supported-platforms-1)*.*

### 3.8 Enroll Compute Node Agent - AWS Nitro

This section describes how to enroll a compute node using AWS Nitro Enclaves on Amazon Linux in Fortanix CCM.

*For more information on how to set up the environment, refer to* [*Enroll a Compute Node Using AWS Nitro on Amazon Linux*](https://support.fortanix.com/hc/en-us/articles/4414195448980-User-s-Guide-Enroll-a-Compute-Node-Using-AWS-Nitro-on-Amazon-Linux#setting-up-the-environment-0-1)*.*

Perform the following steps to generate a join token from Fortanix CCM:

1. In the CCM left navigation panel, click **Infrastructure** → **Compute Nodes**, and then click **+ ADD NODE** for **AWS NITRO ENCLAVES**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3614).png)

**Figure 18: Enroll compute node**
2. In the **ENROLL COMPUTE NODE** dialog box, Fortanix CCM generates a **Join Token** in the **Get a join token to register an SGX compute node** field. This token authenticates the compute node with Fortanix CCM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3615).png)

**Figure 19: Copy join token**
3. Click **COPY** to copy the Join Token.
4. Download the [*Amazon Nitro node agent installer*](https://fortanix.zendesk.com/hc/en-us/articles/4412575587732-Fortanix-Node-Agent-Software-AWS-Nitro-Platform).
5. Extract the contents of the package and open the extracted folder.
6. Open the **README** file, which provides instructions to enroll the compute node in Fortanix CCM, and perform the following steps:
  1. Copy the file `installer.sh` to your Amazon Linux VM.
  2. Run the installer script using the join token copied in *Step 3*:

```bash
sudo bash ./installer.sh <join-token>
```
7. After successful enrollment, the compute node appears in the Compute Nodes overview table in Fortanix CCM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (3616).png)

**Figure 20: Node enrolled**

### 3.9 Run the Application Image on the Enrolled Compute Node

After enrolling the compute node, perform the following steps to run the application image on the AWS Nitro enrolled compute node:

1. Run the following command to install Docker on the enrolled compute node:

```bash
sudo apt install docker.io
```
2. Run the following command to run this application image on the node for AWS Nitro Platform:

```bash
sudo docker run -it --rm --privileged -v /run/nitro_enclaves:/run/nitro_enclaves -e RUST_LOG=debug -e NODE_AGENT=http://172.31.14.110:9092/v1/ -p 80:80 -p 443:443 513076507034.dkr.ecr.us-west-1.amazonaws.com/development-images/em-test-framework-nginx-9913:nitro
```

Where,

> [!NOTE]
> NOTE
> 
> Replace the Node Agent IP address, port number (if modified), and application image name with values specific to your environment. The example shown above is for reference only.
  - `9092` is the default port on which Node Agent listens to.
  - `172.31.14.110` is the Node Agent Host IP.
  - `em-test-framework-nginx-9913:nitro` is the converted app that can be found in the **Images** under the **Image Name** column in the **Images** table.

### 3.10 Azure Confidential VM - Setup and Attestation

*For detailed steps on how to configure a Fortanix CCM deployment with an Azure Confidential Virtual Machine (CVM) environment, refer to the following guides:*

- Linux-based Azure CVM
  - [*Azure Confidential VM Setup - Linux*](https://support.fortanix.com/docs/azure-confidential-vm-setup-linux-1)
  - [*Azure Confidential VM Attestation - Linux*](https://support.fortanix.com/docs/azure-cvm-attestation-guide-linux-1)
- Windows-based Azure CVM
  - [*Azure Confidential VM Setup - Windows*](https://support.fortanix.com/docs/azure-confidential-vm-setup-windows-1)
  - [*Azure Confidential VM Attestation - Windows*](https://support.fortanix.com/docs/azure-confidential-vm-attestation-windows-1)

### 3.11 Enroll Compute Node - Intel TDX

This section describes how to enroll a compute node using bare metal on an Intel TDX platform in Fortanix CCM.

*For more information on how to set up the environment, refer to* [*Enroll a Compute Node (bare meta)- Intel TDX*](/v1/docs/enroll-a-compute-node-bare-metal-intel-tdx-1)*.*

*For detailed steps on how to deploy confidential VM applications on Intel TDX using Fortanix CCM, click* [*here*](/v1/docs/deploy-confidential-vm-applications-on-intel-tdx-using-fortanix-1)*.*

### 3.12 Enroll Compute Node - AMD SEV-SNP

This section describes how to enroll a compute node using bare metal on an AMD SEV-SNP platform in Fortanix CCM.

*For more information on how to set up the environment, refer to* [*Enroll a Compute Node (bare meta) - AMD SEV-SNP*](/v1/docs/enroll-a-compute-node-bare-metal-amd-sev-snp-1)*.*

*For detailed steps on how to deploy confidential VM applications on AMD SEV-SNP using Fortanix CCM, click* [*here*](/v1/docs/deploy-confidential-vm-applications-on-amd-sev-snp-using-fortanix-1)*.*

## 4.0 Where to go from here

Congratulations, you have just deployed your first confidential computing application using the Fortanix Confidential Computing Manager!

After completing the setup, you can explore additional features of Fortanix CCM using the following resources:

- Provision a TLS certificate using CCM: [*Certificate Configuration*](/v1/docs/users-guide-add-and-edit-an-application-1)
- Manage identities and enforce policies for applications and compute nodes
  - [*Application and compute node policy enforcement*](/v1/docs/application-and-compute-node-policy-enforcement-1)
  - [*Compute node labels*](/v1/docs/users-guide-enroll-a-compute-node-using-azure-marketplace-1)
- Build and deploy confidential computing applications in RUST using the Fortanix EDP platform: [*EDP applications on CCM*](/v1/docs/bringing-edp-rust-apps-to-confidential-computing-manager-1).

**For quick support, please join our Slack community:** [*https://fortanix.com/community/*](https://fortanix.com/community/) **Channel:** #enclavemanager

## Related

- [Azure Key Vault Group Setup](/fortanix-dsm-azure-key-vault-cdc-group-setup.md)
- [Fortanix DSM - Quickstart](/fortanix-data-security-manager-quickstart.md)
- [Add Application](/fortanix-ccm-add-and-edit-an-application.md)
- [Enroll a Compute Node Using AWS Nitro on Amazon Linux](/fortanix-ccm-enroll-a-compute-node-using-aws-nitro-on-amazon-linux.md)