Utimaco Enterprise Secure Key Manager

utimaco.com

Free trial WebLinuxAPISelf-hosted

Spec score 7.9 #4 of 25 in Key Management Software

What it is

Utimaco Enterprise Secure Key Manager (ESKM) centralizes cryptographic key management across on-premises and cloud environments. It provides policy controls, centralized administration, and audit trails for key lifecycle management, alongside monitoring, recovery, scheduled backups, log rotation, and restore functions. Administrators can use a web GUI or command-line interface. ESKM supports OASIS KMIP, a RESTful API, and a native XML-based KMS protocol; it conforms to KMIP specifications 1.0 through 2.1 and supports client libraries including OpenKMIP and PyKMIP. The product page states capacity for more than 2 million keys, over 25,000 clients, and thousands of nodes per distributed cluster. Four models are available, including a Linux-based virtual appliance and hardware appliances. Physical L3 and L4 models include embedded HSMs identified as FIPS 140-2 Level 3 and Level 4; the virtual L1 is a hardened appliance with FIPS 140-2 Level 1 security. Listed key types include AES, 3-Key Triple DES, HMAC, RSA, and ECDSA. Pricing is on request.

Spec sheet

What it does: ESKM generates, stores, serves, controls and audits encryption keys for storage systems, application servers and databases.Read 14 Oct 2026 · commoncriteriaportal.org
Purpose: ESKM provides centralized management for cryptographic keys across on-premises and cloud environments.Read 3 Oct 2026 · utimaco.com
Trial: Utimaco offers a fully functional 60-day vESKM trial requiring registration and export-control verification.Read 14 Oct 2026 · utimaco.com
Integrations: Utimaco publishes integration guides for AWS BYOK, Azure BYOK, Google Workspace, Kubernetes, VMware, Dell, HPE, NetApp, Oracle Cloud, Veeam, Splunk, MySQL and other systems.Read 14 Oct 2026 · integration-guides.utimaco.com
Compliance: Utimaco lists FIPS 140-2 levels 1 through 4 by model, NIST SP 800-131A, Common Criteria EAL2+, PCI-DSS controls and HIPAA support; FIPS 140-3 Level 2 is described as pending.Read 14 Oct 2026 · utimaco.com
Support: Utimaco’s support portal offers product documentation, support cases, RMA cases, security advisories, and software downloads.Read 3 Oct 2026 · support.hsm.utimaco.com
Headquarters: Aachen, Germany and Campbell, California, USARead 28 Sep 2026 · utimaco.com
Founded: Utimaco says it was founded by Horst Görtz in 1983.Read 3 Oct 2026 · utimaco.com
Company: Utimaco says it is headquartered in Aachen, Germany, and Campbell, California.Read 3 Oct 2026 · utimaco.com
APIs: ESKM exposes OASIS KMIP, a REST interface and a KMS interface.Read 14 Oct 2026 · utimaco.com
AWS BYOK: The AWS integration generates keys in ESKM and imports them into AWS Key Management Service.Read 14 Oct 2026 · integration-guides.utimaco.com
Azure BYOK: The Azure integration lets customers keep key ownership in ESKM while Azure Key Vault uses the imported keys.Read 14 Oct 2026 · integration-guides.utimaco.com
Capacity: The datasheet states capacity above two million keys, more than 25,000 clients and up to eight ESKM nodes in a distributed cluster.Read 14 Oct 2026 · support.hsm.utimaco.com
Centralized lifecycle: The product centralizes key creation, storage, use, rotation and deletion for on-premises and cloud environments.Read 14 Oct 2026 · azuremarketplace.microsoft.com
Client libraries: The product page says it supports open client libraries including KMIP, OpenKMIP, and PyKMIP, and conforms to KMIP specifications 1.0 through 2.1.Read 3 Oct 2026 · utimaco.com
Common Criteria: The ESKM v5.1 security target claims Common Criteria EAL2 augmented conformance.Read 14 Oct 2026 · commoncriteriaportal.org
Company foundation: LinkedIn lists Utimaco's founding year as 1983 and headquarters in Aachen, North Rhine-Westphalia.Read 14 Oct 2026 · linkedin.com
Company legal name: The Microsoft Azure Marketplace listing identifies the publisher as Utimaco IS GmbH.Read 14 Oct 2026 · azuremarketplace.microsoft.com
Company size: LinkedIn lists Utimaco as privately held with 501-1,000 employees.Read 14 Oct 2026 · linkedin.com
Cryptography: The product page lists AES, 3-Key Triple DES, HMAC, RSA, and ECDSA key types, and says it can manage keys created with NIST- and BSI-recommended post-quantum algorithms.Read 3 Oct 2026 · utimaco.com
Deployment model: ESKM is available in four models, including a virtual appliance and hardware appliances; its data sheet describes the appliance as Linux-based.Read 3 Oct 2026 · support.hsm.utimaco.com
Deployment models: Models include a virtual L1 appliance and physical L2, L3 and L4 1U appliances.Read 14 Oct 2026 · utimaco.com
Documentation: The v5 datasheet package includes a read-me card, user guide, installation guide and release notes.Read 14 Oct 2026 · support.hsm.utimaco.com
External integration evidence: HPE's Data Fabric documentation supports ESKM releases 4.0 and later and notes that authoritative appliance documentation comes from Utimaco.Read 14 Oct 2026 · docs.ezmeral.hpe.com
Hardware security: The physical ESKM L3 and L4 models include embedded HSMs for local key protection; the product page identifies FIPS 140-2 Level 3 and Level 4 for embedded HSMs.Read 3 Oct 2026 · utimaco.com
High availability: ESKM supports multi-site clustering, node failover and encrypted replication of keys and configuration.Read 14 Oct 2026 · support.hsm.utimaco.com
Hypervisors: The vESKM trial page lists VMware vSphere, Hyper-V, KVM and Proxmox as supported deployment hypervisors.Read 14 Oct 2026 · utimaco.com
Interfaces: The product supports OASIS KMIP, a RESTful API, and a native XML-based KMS protocol.Read 3 Oct 2026 · utimaco.com
Key capacity: The product page states capacity for more than 2 million keys, over 25,000 clients, and thousands of ESKM nodes per distributed cluster.Read 3 Oct 2026 · utimaco.com
Key lifecycle: It offers policy controls, centralized administration, and audit trails for key lifecycle management.Read 3 Oct 2026 · utimaco.com
Licence: The trial agreement grants limited use and forbids decompiling, reverse engineering and derivative works, indicating proprietary software.Read 14 Oct 2026 · support.hsm.utimaco.com
Limit: legacy certification: NIST marks the cited ESKM FIPS certificate historical, so it should not be treated as a current validation without checking the exact model and certificate.Read 14 Oct 2026 · csrc.nist.gov
Limit: vulnerability remediation: Utimaco's 2026 bulletin says ESKM v8 versions before 8.54.5 used affected OpenSSL versions and had no temporary workaround; upgrading to 8.54.5 or later is the fix.Read 14 Oct 2026 · support.hsm.utimaco.com
Management interfaces: The evaluated appliance supports HTTPS web administration, SSH command-line administration and serial-console configuration.Read 14 Oct 2026 · csrc.nist.gov
Native protocol: The Common Criteria security target identifies an XML-based ESKM protocol used by clients to request key operations.Read 14 Oct 2026 · commoncriteriaportal.org
NIST validation: NIST records ESKM certificate 1516 as a historical FIPS 140-2 Level 2 hardware validation, with an RNG SP 800-131A transition reason.Read 14 Oct 2026 · csrc.nist.gov
Notable news: EKMaaS: Utimaco announced on 8 October 2025 that its Enterprise Key Manager as a Service supports Microsoft BYOK and sovereign key control using physical HSM protection.Read 14 Oct 2026 · utimaco.com
Operations: Included software features comprise monitoring, recovery, scheduled backups, log rotation, and restore functionality, with a web GUI and command-line interface.Read 3 Oct 2026 · utimaco.com
Ownership: Crunchbase describes Utimaco as Aachen-based and acquired by SGT Capital.Read 14 Oct 2026 · crunchbase.com
Praise: integrations: The Gartner reviewer specifically praised extensive integrations with multiple APIs.Read 14 Oct 2026 · gartner.com
Praise: reliability: The Gartner reviewer praised long service life, frequent upgrades, stable code quality and achieved performance on critical infrastructure.Read 14 Oct 2026 · gartner.com
Pricing availability: The product page directs buyers to contact sales and publishes no list price.Read 14 Oct 2026 · utimaco.com
Rating on Gartner Peer Insights: 5.0 out of 5 from 1 reviewRead 14 Oct 2026 · gartner.com
Rating on Gartner vendor page: 0.0 out of 5 from 0 reviewsRead 14 Oct 2026 · gartner.com
SDK: The datasheet says a client SDK is available for partner and customer native integrations.Read 14 Oct 2026 · support.hsm.utimaco.com
Security controls: The datasheet lists signed software, encryption of keys and backups at rest and in transit, certificate mutual authentication and audit logging.Read 14 Oct 2026 · support.hsm.utimaco.com
Support and services: Utimaco lists installation, startup, upgrade, migration and training services, while support must be ordered with a single-node server.Read 14 Oct 2026 · support.hsm.utimaco.com
System requirements: The stated minimum vESKM configuration is 140 GB disk, 4 GB RAM, two vCPUs and VMware vCenter 6.5 or later.Read 14 Oct 2026 · utimaco.com
Virtual appliance: vESKM is a preconfigured hardened virtual appliance that can connect to Utimaco certified general-purpose HSMs.Read 14 Oct 2026 · utimaco.com
Virtual model: The virtual ESKM L1 is described as a pre-configured, security-hardened virtual appliance with FIPS 140-2 Level 1 security.Read 3 Oct 2026 · utimaco.com

Plans and prices

Enterprise Secure Key Manager Priced on request ESKM L1 virtual appliance · L2-L4 1U hardware appliances · client licensing Read 14 Oct 2026 · utimaco.com

Enterprise Secure Key Manager (ESKM) Priced on request Transparent client licensing · no hidden costs tied to key volume or scalability · four models Read 3 Oct 2026 · utimaco.com

Every Utimaco Enterprise Secure Key Manager plan and price →

Strong points and limits

Strong points

Centralized lifecycle controls include policy administration and audit trails.
States capacity for over 2 million keys and 25,000 clients.
Supports KMIP, REST, and a native XML-based protocol.
Physical models include embedded HSMs with listed FIPS levels.

Limits

Pricing is on request.
Hardware and virtual models have different listed HSM security levels.

Who it suits

ESKM suits organizations managing cryptographic keys across on-premises and cloud environments, particularly those needing centralized controls, audit trails, and HSM-backed options. Its listed integrations and interfaces may also suit environments using the named platforms and protocols.

Verdict

ESKM lays out its interfaces, capacity, operational features, and model distinctions clearly. Buyers will need to request pricing and match the appliance model to their security requirements.