---
title: "Managing the Key Management Service"
slug: "managing-the-key-management-service-4-1-1"
tags: ["Portal"]
status: "update"
updated: 2026-03-04T08:30:10Z
published: 2026-03-29T08:20:24Z
canonical: "kb.ctera.com/managing-the-key-management-service-4-1-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing the Key Management Service

Enterprises running services and applications that need to perform cryptographic operations, can delegate the key management task to an external provider using the Key Management Interoperability Protocol (KMIP). KMIP simplifies the way you manage cryptographic keys, eliminating the need for redundant, incompatible key management processes.

In CTERA Portal, each folder group has an AES-256 data encryption key used for data-at-rest encryption of all the blocks in this folder group. The data encryption keys for each folder group are stored in the CTERA Portal metadata database. When Key Management is enabled, each data encryption key in the database is stored encrypted and this encryption is performed with a separate key encryption key (KEK) that is obtained from the Key Management Server. The key encryption key is never stored persistently outside of the key management server, and can be rotated periodically on a configurable schedule by the Key Management Server.

CTERA Portal integrates with *Thales CipherTrust Manager* for the Key Management Server.

**Note**

The CTERA Portal must be licensed to use the Key Management service. To add a license see [Installing the Portal License](/v1/docs/installing-the-portal-license-4-2). The portal is licensed for **Enhanced Encryption**.