infisical kmip

Description

The Infisical KMIP server provides Key Management Interoperability Protocol (KMIP) support for integration with KMIP-compatible clients. It acts as a proxy between your KMIP clients and Infisical KMS, enabling standardized key management operations.

The server is created in Infisical and then enrolled from the host where you run it, using either a one-time enrollment token or AWS authentication. The deploy command (including the enrollment token) can be copied from the server's detail page via Show deploy command.

The server's certificate configuration (hostnames/IPs, TTL, and key algorithm) is defined on the server entity in the UI. The CLI fetches it on start, so you do not pass it on the command line. To change the certificate, edit the configuration in the UI and restart the server.

For detailed information about KMIP integration, PKI setup, and client configuration, see the KMIP Integration Guide.

Subcommands & flags

infisical kmip start <server-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain>

Once started, the KMIP server will:

• Authenticate to Infisical using the enrollment method you provide
• Listen for incoming KMIP client connections
• Forward KMIP operations (Create, Get, Activate, Revoke, etc.) to Infisical KMS
• Handle mTLS authentication for KMIP clients

Arguments

<server-name> (required): the name of the KMIP server, passed as the first positional argument. The name scopes where enrollment state is stored locally, so use the same value across restarts. You can alternatively supply it with the --server-name flag or the INFISICAL_KMIP_SERVER_NAME environment variable instead of positionally.

Flags

```bash
# Example
infisical kmip start <server-name> --enroll-method=token --token=<enrollment-token>
```

You may also set this via the environment variable `INFISICAL_KMIP_ENROLL_METHOD`.

On restart, the CLI reuses the long-lived access token it stored at enrollment, so the token is only needed for the initial deployment.

```bash
# Example
infisical kmip start <server-name> --enroll-method=token --token=<enrollment-token>
```

```bash
# Example
infisical kmip start <server-name> --enroll-method=aws --kmip-server-id=<kmip-server-id>
```

You may also set this via the environment variable `INFISICAL_KMIP_SERVER_ID`.

```bash
# Example (equivalent to: infisical kmip start production-kmip --enroll-method=token --token=<enrollment-token>)
infisical kmip start --server-name="production-kmip" --enroll-method=token --token=<enrollment-token>
```

You may also set this via the environment variable `INFISICAL_KMIP_SERVER_NAME`.

```bash
# Example
infisical kmip start <server-name> --domain=https://app.your-domain.com --enroll-method=token --token=<enrollment-token>
```

You may also set this via the environment variable `INFISICAL_API_URL`.

```bash
# Example - listen on all interfaces
infisical kmip start <server-name> --listen-address="0.0.0.0:5696" --enroll-method=token --token=<enrollment-token>
```

You may also set this via the environment variable `INFISICAL_KMIP_LISTEN_ADDRESS`.

This flag applies only to legacy machine-identity KMIP servers. For servers enrolled via token or AWS, the certificate TTL is configured on the server entity in the UI and read on start, so this flag is ignored.

```bash
# Example
infisical kmip start <server-name> --certificate-ttl="6m" --enroll-method=token --token=<enrollment-token>
```

You may also set this via the environment variable `INFISICAL_KMIP_CERTIFICATE_TTL`.

This flag applies only to legacy machine-identity KMIP servers. For servers enrolled via token or AWS, the hostnames/IPs are configured on the server entity in the UI and read on start, so this flag is ignored.

```bash
# Example
infisical kmip start <server-name> --hostnames-or-ips="kmip.example.com,10.0.1.50" --enroll-method=token --token=<enrollment-token>
```

You may also set this via the environment variable `INFISICAL_KMIP_HOSTNAMES_OR_IPS`.

sudo infisical kmip systemd install <server-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain>
sudo systemctl start infisical-kmip

For token enrollment, the single-use token is exchanged for a long-lived access token at install time and persisted to the service config; the service reuses it on every restart. For AWS enrollment, no token is stored and the server re-authenticates via STS on each start.

Requirements

• Must be run on Linux
• Must be run with root/sudo privileges
• Requires systemd

What it does

1. Creates a config file at /etc/infisical/kmip.conf with the provided enrollment settings
2. Creates a systemd service file at /etc/systemd/system/infisical-kmip.service
3. Reloads the systemd daemon
4. Enables the service to start on boot

Arguments & Flags

Like infisical kmip start, this command takes the <server-name> as a required positional argument (or via --server-name / INFISICAL_KMIP_SERVER_NAME). It accepts the same flags as infisical kmip start (documented above): --enroll-method, --token, --kmip-server-id, --server-name, --domain, --listen-address, and (for legacy machine-identity servers only) --hostnames-or-ips and --certificate-ttl.

Service Details

The systemd service is installed with secure defaults:

• Service file: /etc/systemd/system/infisical-kmip.service
• Config file: /etc/infisical/kmip.conf
• Automatically restarts on failure
• Enabled to start on boot

After installation, manage the service with standard systemd commands:

sudo systemctl start infisical-kmip    # Start the service
sudo systemctl stop infisical-kmip     # Stop the service
sudo systemctl status infisical-kmip   # Check service status
sudo systemctl disable infisical-kmip  # Disable auto-start on boot
sudo journalctl -u infisical-kmip      # View logs

sudo infisical kmip systemd uninstall

Requirements

• Must be run on Linux
• Must be run with root/sudo privileges

What it does

1. Stops the service if running
2. Disables the service
3. Removes the service file from /etc/systemd/system/infisical-kmip.service
4. Removes the config file from /etc/infisical/kmip.conf
5. Reloads the systemd daemon