docs/documentation/platform/pki/settings/hsm-connectors-fortanix-dsm.mdx
Infisical connects to Fortanix Data Security Manager (DSM) through an HSM Connector. Once connected, Infisical features that support HSM-backed keys can generate and use keys that stay in your Fortanix DSM. This guide covers the full setup: installing the Fortanix PKCS#11 driver on a Gateway inside your network, pointing it at your DSM, and creating the Connector in Infisical.
HSM Connectors > Create).Infisical reaches your DSM through the HSM Connector. Each operation goes from Infisical to the Connector, which routes it to a Gateway inside your network. The Gateway loads the Fortanix PKCS#11 driver, runs the operation against your DSM, and returns the result. DSM is reached only through the Connector and its Gateway, never from Infisical directly.
flowchart LR
Infisical["Infisical"]
Connector["HSM Connector"]
subgraph Gateway["Gateway host (your network)"]
Driver["Fortanix PKCS#11 driver"]
Conf["pkcs11.conf
api_endpoint"]
Conf -- "points driver at DSM" --> Driver
end
DSM["Fortanix DSM"]
Infisical --> Connector
Connector -- "API key (sent as the PIN)" --> Driver
Driver -- "connects and authenticates" --> DSM
Two pieces of configuration are involved, and they are separate:
pkcs11.conf) on the Gateway host tells the Fortanix driver which DSM endpoint to connect to. This is the standard Fortanix client configuration that any PKCS#11 application uses.Your API key is a credential, so it goes only in Infisical as the PIN. It does not belong in pkcs11.conf.
The application can only use keys in the groups it belongs to (shown in the **Groups** section of the app), so make sure the keys you want Infisical to use live in a group this app can access.
You will enter this API key in Infisical as the Connector's PIN in the final step.
Confirm the driver file is readable by the Gateway user:
```bash
ls -l /opt/fortanix/pkcs11/fortanix_pkcs11.so
```
Create the Fortanix client configuration file at `/etc/fortanix/pkcs11.conf` with the DSM endpoint for your region:
```toml
api_endpoint = "https://amer.smartkey.io"
```
This is the only setting the driver needs here. Infisical supplies the API key as the PIN in the final step.
<Tabs>
<Tab title="Linux (systemd)">
```bash
sudo infisical gateway systemd install <gateway-name> \
--enroll-method=token \
--token=<enrollment-token> \
--domain=<your-infisical-domain> \
--pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so
sudo systemctl start <gateway-name>
```
</Tab>
<Tab title="Foreground">
```bash
infisical gateway start <gateway-name> \
--enroll-method=token \
--token=<enrollment-token> \
--domain=<your-infisical-domain> \
--pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so
```
</Tab>
</Tabs>
The Gateway logs a line confirming the PKCS#11 module loaded.
| Field | Value |
|-------|-------|
| **Name** | Slug-friendly identifier, e.g. `fortanix-prod`. |
| **Gateway** | The Gateway you started above (or a Pool that contains it). |
| **Slot label** | `Fortanix Token` by default. If you configured a custom token label, use that value instead. |
| **PIN** | Your Fortanix application API key from Step 1. |
| **Key label prefix** | Optional prefix added to every key label Infisical creates in this slot. |
```bash
pkcs11-tool --module /opt/fortanix/pkcs11/fortanix_pkcs11.so --list-token-slots
```
On Fortanix DSM the value is `Fortanix Token`.