--- title: "Setting Up Key Management for a CTERA Portal" slug: "setting-up-key-management-for-a-ctera-portal-5-1-1" tags: ["Portal", "8.4"] updated: 2026-11-08T13:24:39Z published: 2026-11-08T13:24:39Z canonical: "kb.ctera.com/setting-up-key-management-for-a-ctera-portal-5-1-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.ctera.com/llms.txt > Use this file to discover all available pages before exploring further. # Setting Up Key Management for a CTERA Portal Setting up key management involves the following steps: - [Generating Keys for the Key Management Service](/v1/docs/setting-up-key-management-for-a-ctera-portal-5-1-1#generating-keys-for-the-key-management-service) - [Setting Up the CTERA Portal Key Management Service](/v1/docs/setting-up-key-management-for-a-ctera-portal-5-1-1#setting-up-the-ctera-portal-key-management-service) ## Generating Keys for the Key Management Service The server and client keys are generated in Thales CipherTrust Manager. The procedures described below use a local server certificate. If you want to use an external server certificate, replace **Local** with **External** in the procedures. **To add the server certificate to Thales CipherTrust Manager:** 1. Access the Thales CipherTrust Manager as an administrator. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-K9OU36YK.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 2. Click the **CA > Local** in the navigation pane. The **Local Certificate Authorities** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-OTRRQI3C.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 3. Click the **Add Local CA**. The **Add Local CA** window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-MMW6GEWH.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) **Note** If using an external certificate, you copy and paste the certificate in the following window and click **Save**: ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-F6L2YZUV.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 4. Enter the information for the certificate and click **Create Local CA**. The **Local Certificate Authorities** page is redisplayed, showing the local server certificate. 5. Click the ellipsis (`...`) on the right of the certificate and then click **Download**. **To generate the client private key and certificate:** 1. Access the Thales CipherTrust Manager as an administrator. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PSMCWJ7N.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 2. Click the **KMIP** product. The **Registered Clients** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-K98776EQ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 3. Click the **Client Profile** in the navigation pane. The **Client Profiles** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-10318WI4.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 4. Click the **Add Profile**. The **Add Profile** window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-43P48BC2.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 5. Enter a **Profile Name** and click **Save**. 6. Click **Registration Token** in the navigation pane. The **Registration Token** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-NWBM7K72.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 7. Click New **Registration Token**. The **Create New Registration Token** window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-VFRSQ5W2.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 8. Click **Begin**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-AIF9CY2P.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 9. Provide a **Name prefix** for the token and click **Select CA**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-FIT1DVJD.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 10. Choose **Local CA** and select the CA from the drop-down list. This is the certificate added to Thales CipherTrust Manager. 11. Click **Select Profile**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-LWTY8R71.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 12. Choose either the **Client Profile** from the drop-down list and click **Create Token**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-7CNUGJX9.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 13. Copy the token and click **Done**. The **Registration Token** page is redisplayed, showing the token that was created. 14. Click **Registered Clients** in the navigation pane. The **Registered Clients** page is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-VU2CD58I.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 15. Click **Add Client**. The **Add Client** window is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-QDMXO2Z9.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 16. Enter a **Name** and the **Registration Token**, copied in step 13 and, if required, the **Client certificate** and click **Save**. The **Add Client** window is displayed with buttons to download the client private key and certificate and a CSR. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-MQ4O8WDY.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 17. Click the **Save Private key** and **Save Certificate** buttons to download the private key and client certificate. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-IC10FTL6.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) **Warning** If you do not download the private key, you cannot get it later and will not be able to set up key management in CTERA Portal with this key and certificate. **Note** You can download the certificate later. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-AKN04VRB.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) ## Setting Up the CTERA Portal Key Management Service You can specify key management server settings and authentication specifications. **To set up key management:** 1. In the global administration view, select **Security > Key Management** in the navigation pane. The **Key Management** page is displayed. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-9NBC0DLU.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) **Note** You require a license to use key management. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-VM2H140I.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 2. Click **Configure Service**. The **Settings** page is displayed. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-BXQW59M9.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) **Key Server Type** – The type of key manager server. Currently, only *Thales CipherTrust* is supported. **Timeout** – The amount of time to wait for a reply from the key management server before the operation times out. **Key expiration** – The amount of time before the key encryption keys become invalid. **Note** Keys are automatically rotated before they expire. **Port** – The port used by the key management server. 3. Select the **Client Certificate** tab to upload the client certificate. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-EURH4DR6.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 4. Click ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-ODUY0XOK.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) **Select File** to select the .pem file KMS client certificate to use, from the procedure described in [Generating Keys for the Key Management Service](/v1/docs/setting-up-key-management-for-a-ctera-portal-5#generating-keys-for-the-key-management-service) procedure. **Note** Only .pem files are allowed. 5. Click ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-ODUY0XOK.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) **Select File** to select the private key, from the procedure described in [Generating Keys for the Key Management Service](/v1/docs/setting-up-key-management-for-a-ctera-portal-5#generating-keys-for-the-key-management-service) procedure. The private key must match the KMS certificate. 6. Select the **KMS Server Certificate** tab to upload the server certificate. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PD3V9NUO.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) 7. Click **Select File** to select the .pem file KMS server certificate to use, from the procedure described in [Generating Keys for the Key Management Service](/v1/docs/setting-up-key-management-for-a-ctera-portal-5#generating-keys-for-the-key-management-service) procedure. **Note** Only .pem files are allowed. The certificate must match the client certificate. 8. Click **Save**. If there is a problem with the certificate, for example the client and server certificates do not match, an error is displayed, with additional information written to the log. You can use more than one key management server and CTERA recommends using more than one key management server for high availability. All the key management servers are expected to be members of a synchronized cluster. All the key management servers use the same client certificate and private key and server certificate and **not** a separate set per server. **To add or edit a key management server:** 1. In the global administration view, select **Security > Key Management** in the navigation pane. The **Key Management** page is displayed. 2. To add a key management server, click **Add a Server**. The **New Key Server** page is displayed. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-K40Z45W7.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) Or, To edit an existing key management server, click the server’s name. The key server window is displayed with the server as the window title. 3. Specify the details: **Name** – A display name for the server. **Host** – The IP address or DNS name of the server. 4. Click **Save**. The server is added to the list of key management servers and the service status is **Active**. ![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-115T8QBO.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A19%3A05Z&se=2026-11-11T05%3A19%3A05Z&sr=c&sp=r&sig=0VJ3d%2B37bykuby%2BfjEb6Spv0SkqzcdOLPo7GFYG74vY%3D) Any new folder group uses managed keys to access the folder group content. All existing folder groups are transitioned to use managed keys by a task that runs in the background. Each folder group has a key in the key management server. After a file is accessed in the folder group for the first time, the key is saved in a cache in the CTERA Portal. As long as the key is in the cache, access to the files in the folder group is quicker, and access is still possible, even if the key management server is not running.