Skip to main content
Each KMIP client is registered in one KMS project, and can use only that project’s keys. The client authenticates to the KMIP server with a certificate that Infisical issues for it.

​
Prerequisites

  • A running KMIP server
  • A KMS project where you have the Admin role
  • A KMIP client that supports KMIP 1.0 to 1.4, and can reach the KMIP server on port 5696

​
Step 1: Register the client

1
In your KMS project, go to KMIP and select Add KMIP Client.
2
Enter a Name, and select the Permissions for the KMIP operations the client can run, such as Create, Get, and Locate.
3
Select Add KMIP Client.

​
Step 2: Create the client’s certificate

1
Select the options menu on the client’s row, then select Generate Certificate.
2
Pick a Request Method:
  • Managed: Infisical creates the client’s private key and certificate. Enter a Key Algorithm
  • Certificate Signing Request (CSR): If the client creates its own private key, paste the client’s CSR. The CSR’s subject must use the Client ID as the common name (CN) and the Project ID as the organizational unit (OU), as shown under Certificate Subject Values
3
Enter a TTL for the certificate, such as 1y, then select Generate Certificate or Sign Certificate.
4
Before you close the dialog, save the Certificate Body, the Certificate Chain, and, for a Managed certificate, the Certificate Private Key.

​
Step 3: Configure the client

The settings differ between clients, but most clients need the following:
  • Server address: One of the hostnames or IP addresses you set on the KMIP server, with port 5696, such as kmip.example.com:5696
  • Client certificate: The Certificate Body
  • Client private key: The Certificate Private Key
  • CA certificate: The Certificate Chain, which the client uses to check the KMIP server’s certificate
For example, a PyKMIP client configuration looks like this:
To check the connection, run a simple operation from the client, such as creating a test key.

​
Troubleshooting

  • Check that the client can reach the KMIP server on the port it’s listening on (5696 by default)
  • Check that the KMIP server’s --listen-address is an address the client can reach. If it’s bound to 127.0.0.1, only clients on the same machine can connect. Use the server’s network IP, or 0.0.0.0 to listen on all interfaces.
  • Check that the server address the client uses is one of the hostnames or IP addresses set on the KMIP server
  • Check that the client’s certificate hasn’t expired
To see the details of the TLS connection, run the following command from the client’s machine:
If the connection works, the output includes the KMIP server’s certificate chain.
Check that the client has the permission for the operation. In your KMS project, go to KMIP, select the options menu on the client’s row, and select Edit KMIP Client.For more detail, check the KMIP server’s logs.