--- title: "KMS configuration with Nutanix on OVHcloud" description: "Learn how to configure the OVHcloud Key Management System (KMS) with Nutanix on OVHcloud." url: https://docs.us.ovhcloud.com/en/hosted-private-cloud/nutanix-on-ovhcloud/kms-configuration lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # KMS configuration with Nutanix on OVHcloud **Learn how to configure the OVHcloud Key Management System (KMS) with Nutanix on OVHcloud.** Nutanix provides two options for securing data at rest: - **Self-Encrypted Drives (SEDs)** - **Software-only encryption**, which offers key-based access management through either the cluster's native key manager or an **external key management system (KMS)**. By following this guide, you will learn how to leverage **Nutanix's data-at-rest encryption** capabilities using the **OVHcloud KMS**.   ## Requirements - A **valid OVHcloud KMS key** in your [OVHcloud account](https://manager.us.ovhcloud.com/) (see [this guide](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/quick-start.md) for instructions) - A [Nutanix on OVHcloud](https://us.ovhcloud.com/hosted-private-cloud/nutanix/) cluster in your OVHcloud account **Note:** The cluster must be **compatible with Data-At-Rest Encryption**. Please confirm this with your OVHcloud sales representative or with [the support teams](https://docs.us.ovhcloud.com/en/account/account-information/contact-us-support.md). A **Nutanix license** that [supports the **Data-At-Rest Encryption** feature](https://docs.us.ovhcloud.com/en/hosted-private-cloud/nutanix-on-ovhcloud/packaged-service-included-licenses.md#some-key-features-and-differences-between-packs). - Access to the Nutanix cluster via **Prism Central/Prism Element** - Compliance with Nutanix’s feature guidelines (e.g., [Nutanix Security Guide](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_0:wc-security-data-encryption-wc-c.html) and [Nutanix KMS Compatibility Matrix](https://portal.nutanix.com/page/documents/compatibility-interoperability-matrix/software?partnerName=OVHCloud\&solutionType=KMS%20%28Key%20Management%20Solutions%29\&componentVersion=External%20Key%20Managers\&hypervisor=all\&validationType=all))   ## Instructions ### Step 1 - Access Prism Central and Prism Element Log in to Prism Central (see full instructions here). Navigate to _Prism Element_ by clicking your cluster in the **Cluster Quick Access** panel. Select `Home` and choose `Settings`.   ### Step 2 - Configure Data-at-Rest Encryption Scroll to the **Security** section and click `Data-at-rest Encryption`. Click on `Edit Configuration`. Complete all fields and supply the requested files while scrolling through the following page. Click each tab below for more information on each section. #### Encryption Type Select an encryption type based on your service and license compatibility. See the [requirements](#requirements) section for more information. #### Select Key Management Server (KMS) Select `An external KMS`. #### Certificate Signing Request Information Enter your configuration details to generate the Certificate Signing Request (CSR). **Warning:** **NOTE:** This is required to complete this process. Click `Save CSR Info` and then click `Download CSRs`. Take note of where the file is saved on your computer. **Note:** You will need to generate **Access Certificates** for each node in your cluster using the CSRs you downloaded. See our [Getting started with Key Management Services](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/quick-start.md#creating-an-access-certificate) guide for full instructions. #### Key Management Server Click `Add New Key Management Server`. Enter a Name, Address, and Port for your KMS service and click `Save`. #### Click here for instructions on retrieving the Address and Port. From the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/), navigate to the `Hosted Private Cloud` tab. In the left-hand menu, select `Identity, Security & Operations`, then `Key Management Service`, and then your KMS service. In the **General information** tab, copy the **KMIP**.   Click on `Manage Certificates`. Upload the Access Certificates for each of the nodes on your cluster by clicking `Upload Files`, selecting your file(s), and clicking `Submit`. **Note:** If you are unsure how to make Access Certificates, see the information in the _Certificate Signing Request Information_ tab. ##### Add New Certificate Authority Click `Add New Certificate Authority`. On the next screen, name and upload a Certificate Authority file with a `.cert` extension. #### Click here for instructions on retrieving the Certificate Authority. 1. From the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/), copy the **Id** for your KMS service. 2. From the [OVHcloud API](https://api.us.ovhcloud.com/), run the following API call. > Parameters > > - **okmsId:** retrieved in the previous step > - **publicCA:** set to "true" `GET /okms/resource/{okmsId}` 3. Save the "publicCA" line of the results as a text file. 4. Convert the `.txt` into the correct format. The text file will need to be edited so that all instances of `/n` are replaced with carriage returns. Once that process is complete, change the file extension to `.cert`.   ### Step 3 - Test and Enable Encryption Back at the **Key Management Server** menu, click `Manage Certificates` again. `Test all nodes` in the cluster. If the test is successful, you can now enable encryption for your Nutanix cluster. You can enable both **software encryption** and **Self-Encrypting Drives (SEDs)**.   ## Go further - [Nutanix Security Guide for Data-at-Rest Encryption](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v7_0:wc-security-data-encryption-wc-c.html) - [Getting started with OVHcloud Key Management Service (KMS)](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/quick-start.md) - [Nutanix Compatibility Matrix](https://portal.nutanix.com/page/documents/compatibility-interoperability-matrix/software?partnerName=OVHCloud\&solutionType=KMS%20%28Key%20Management%20Solutions%29\&componentVersion=External%20Key%20Managers\&hypervisor=all\&validationType=all) Browse all the [Nutanix guides](https://docs.us.ovhcloud.com/en/hosted-private-cloud/nutanix-on-ovhcloud/landing-page-nutanix-on-ovhcloud.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Nutanix on OVHcloud](https://us.ovhcloud.com/hosted-private-cloud/nutanix/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.