> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Dell PowerEdge SEKM with KMIP

> Encrypt the drives in Dell PowerEdge servers with keys from Infisical KMS.

Dell PowerEdge servers can encrypt their self-encrypting drives (SEDs) with keys from a KMIP key manager, through a feature of iDRAC called Secure Enterprise Key Management (SEKM). This guide sets up iDRAC as a [KMIP client](https://infisical.com/docs/documentation/platform/kms/kmip-clients.md) of Infisical KMS.

## Prerequisites

* A running [KMIP server](https://infisical.com/docs/documentation/platform/kms/kmip-server.md) that iDRAC can reach on port 5696
* A KMS project where you have the **Admin** role
* A Dell PowerEdge server with an iDRAC Enterprise license and an SEKM license

## Step 1: Register iDRAC as a KMIP client

**Step 1**

In your KMS project, go to **KMIP** and select **Add KMIP Client**.

**Step 2**

Enter a **Name**, select every operation under **Permissions**, then select **Add KMIP Client**.

**Step 3**

Select the options menu on the client's row, select **Generate Certificate**, and set **Request Method** to **Certificate Signing Request (CSR)**. Keep the dialog open: you need the **Client ID** and **Project ID** it shows in the next step.

## Step 2: Create a certificate request on iDRAC

**Step 1**

In the iDRAC web interface, go to **iDRAC Settings** > **Services**, expand **iDRAC Key Management**, and select **SEKM**.

**Step 2**

Enter the KMIP server's address and port `5696`, then select **Next**.

**Step 3**

Select **Generate CSR**, and fill in the certificate fields:

* **Common Name (CN)**: The **Client ID** from Infisical
* **Organizational Unit (OU)**: The **Project ID** from Infisical
* Any other fields your organization requires, such as **Organization** and **Country**

**Step 4**

Select **Generate**, and download the certificate request.

## Step 3: Sign the certificate in Infisical

**Step 1**

In the Infisical dialog, paste the certificate request into **Certificate Signing Request (CSR)**.

**Step 2**

Enter a **TTL**, such as `1y`, then select **Sign Certificate**.

**Step 3**

Download the **Certificate Body** and the **Certificate Chain**.

## Step 4: Finish the setup on iDRAC

**Step 1**

In iDRAC, upload the **Certificate Body** as the client certificate, and the **Certificate Chain** as the KMS CA certificate.

**Step 2**

Select **Test Network Connection**, then finish the SEKM setup.

**Step 3**

Turn on encryption for your storage controller (PERC, HBA, or NVMe) in iDRAC.

## Troubleshooting

* **Certificate validation fails**: Check that the certificate request used the **Client ID** as the common name and the **Project ID** as the organizational unit
* **Connection times out**: Check that iDRAC can reach the KMIP server, and that your firewall allows traffic on port 5696
* **Authentication fails**: Check that you uploaded both the client certificate and the certificate chain to iDRAC


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.