KMIP Integration

​

How KMIP Works with Infisical

1. KMIP clients (your applications or tools) communicate with the KMIP server
2. The KMIP server acts as a proxy and forwards requests to Infisical KMS
3. The KMIP server authenticates to Infisical using a machine identity

​

Supported Operations

• Create - Generate symmetric keys
• Register - Register externally created keys
• Locate - Find keys using attributes
• Get - Retrieve keys securely
• Activate - Enable keys for usage
• Revoke - Revoke existing keys
• Destroy - Permanently remove keys
• Get Attributes - Retrieve metadata associated with keys
• Query - Query server capabilities and supported operations

​

Compatibility

​

Network Requirements

• KMIP Client → KMIP Server: KMIP clients must be able to reach the KMIP server on port 5696 (or your configured port). Ensure firewalls allow this traffic and DNS resolution works if using hostnames.
• KMIP Server → Infisical Platform: The KMIP server needs outbound HTTP access to Infisical. For self-hosted instances, ensure connectivity to your custom domain.

​

Configure and Deploy the KMIP Server

1

Enable KMIP at the Organization Level

First, you need to enable KMIP for your entire Infisical organization and set up its PKI infrastructure.Navigate to Organization Settings > KMIP and click Setup KMIP.In the modal, select the desired key algorithm to use for the KMIP PKI of your organization, then click Continue.This generates the KMIP PKI for your organization, creating the cryptographic foundation that will be used for secure KMIP communications.

You do not need to manage these certificates yourself; Infisical handles the PKI infrastructure for you.

2

Create a Machine Identity for the KMIP Server

The KMIP server needs a machine identity to authenticate with Infisical and proxy requests on behalf of clients.Configure a machine identity by heading to your organization’s Access Control and switching over to the identities tab. From there you can click Create Identity.This guide assumes you’ll be using the Universal Auth method for the machine identity but you can choose any supported authentication method.This machine identity will be used by the KMIP server to authenticate and forward client requests to Infisical KMS.

3

Create a Custom Organization Role with Proxy KMIP Permission

The machine identity needs permission to proxy KMIP requests.Create a custom organization role and give it the Proxy KMIP permission.This permission allows the KMIP server to act as an intermediary between KMIP clients and Infisical.

4

Assign the Organization Role to the Machine Identity

Now connect the machine identity to the role you just created.Assign the machine identity to the custom organization role.This grants the machine identity the ability to serve KMIP client requests and forward them from your KMIP server to Infisical.

5

Deploy the KMIP Server

Now you’re ready to deploy the KMIP server. You can run the KMIP server on any infrastructure that can reach the Infisical platform, such as a VM or container.Once you have your infrastructure ready, you’ll need to install the Infisical CLI on the server where you want to run the KMIP server.To install the latest Infisical CLI visit Infisical CLI instructions. If you need to install specific versions of the CLI, you can find them on the Infisical CLI GitHub Releases.Then, launch the KMIP server with the following command:

Copy

Ask AI

infisical kmip start \
  --identity-client-id=example-client-id \
  --identity-client-secret=example-client-secret \
  --domain=https://my-infisical-instance.com \
  --listen-address="0.0.0.0:5696" \
  --hostnames-or-ips="my-kmip-server.com"

Available flags:

• listen-address (default: localhost:5696): The address the KMIP server listens on. In most cases you’ll want to listen on all interfaces (0.0.0.0:5696)
• identity-auth-method (default: universal-auth): The authentication method for the machine identity
• identity-client-id: The client ID of the machine identity (can be set via INFISICAL_UNIVERSAL_AUTH_CLIENT_ID env var)
• identity-client-secret: The client secret of the machine identity (can be set via INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET env var)
• server-name (default: “kmip-server”): The name of the KMIP server
• certificate-ttl (default: “1y”): The duration for which the server certificate is valid
• hostnames-or-ips: The IP address or the hostname of the server where you have deployed the KMIP server.

Once started, your KMIP server is now running and ready to accept client connections. It will authenticate to Infisical using the machine identity and proxy all KMIP operations.

6

Navigate to Your KMS Project

Now that the KMIP server is running, you need to register KMIP clients that will connect to it.Navigate to the desired KMS project if you already have one or create a new project of type KMS, then select KMIP once inside the project, and click Add KMIP Client.

7

Configure the KMIP Client

Define the client and its permissions.In the modal, provide the details of your client. The selected permissions determine what KMIP operations (Create, Get, Revoke, etc.) can be performed in your KMS project.This creates a KMIP client entity in Infisical that will be authenticated via mTLS certificates.

8

Generate Client Certificate

Each KMIP client needs its own certificate for mTLS authentication.Click Generate Certificate for your newly created client.Provide the desired TTL (time-to-live) and key algorithm, then click Generate Client Certificate.Download the generated client certificate, certificate chain, and private key.Configure your KMIP-compatible applications or tools to use these credentials when connecting to the KMIP server. The client will now authenticate via mTLS and perform authorized key management operations through the KMIP server, which proxies requests to Infisical KMS.

​

Connecting your KMIP Client to Infisical

1. KMIP Server Address: The hostname or IP and port where your KMIP server is listening (e.g., my-kmip-server.com:5696)
2. Client Certificates: The certificate credentials generated from your Infisical KMS project:
   • Client Certificate (client-cert.pem) - Identifies your KMIP client
   • Client Private Key (client-key.pem) - Used for mTLS authentication
   • Certificate Chain (cert-chain.pem) - Verifies the KMIP server

​

General Configuration Steps

[client]
host=my-kmip-server.com
port=5696
certfile=/path/to/client-cert.pem
keyfile=/path/to/client-key.pem
ca_certs=/path/to/cert-chain.pem

openssl s_client -connect kmip-server-ip-here:5696 --cert /path/to/client-cert.pem --key /path/to/client-cert.pem --CAfile /path/to/cert-chain.pem --tls1_2 --showcerts --state --debug