Skip to main content
The Key Management Interoperability Protocol (KMIP) is a standard protocol that storage arrays, databases, servers, and backup tools use to get their encryption keys from a key manager. With KMIP, these clients can create and fetch keys in Infisical KMS.
KMIP is available under Infisical’s Enterprise plan. If you’re self-hosting Infisical, contact [email protected] to purchase an enterprise license.
KMIP clients don’t connect to Infisical directly. They connect to a KMIP server that you run on your own network with the Infisical CLI, and the KMIP server passes each request on to Infisical:
  1. A KMIP client connects to the KMIP server on port 5696, and authenticates with a client certificate that Infisical issued
  2. The KMIP server sends the request to Infisical over HTTPS
  3. Infisical runs the request against the keys in the client’s KMS project
You create a KMIP server once for your organization, and any KMS project can use it. You register each client in the KMS project whose keys the client uses.Unlike the Infisical API, KMIP gives the client the key material, and the client encrypts data itself. This means you shouldn’t rotate a key that a KMIP client uses.

​
Set up KMIP

Deploy a KMIP server

Run the KMIP server that your KMIP clients connect to.

Connect KMIP clients

Connect a KMIP client to the keys in a KMS project.
To set up a specific client, see Dell PowerEdge SEKM.

​
Supported KMIP versions and operations

The KMIP server supports KMIP versions 1.0 to 1.4, and the following operations on symmetric keys: When you register a client, you choose which of these operations the client can run.