# Manage KMS using the GUI

Using the GUI, you can:

* [Add a KMS](#add-a-kms)
* [View the KMS](#view-the-kms)
* [Update the KMS configuration](#update-the-kms-configuration)
* [Remove the KMS](#remove-the-kms)

## Add a KMS

**Procedure**

1. From the menu, select **Configure > Cluster Settings**.
2. From the left pane, select **Security**.
3. On the **Security** page, select **Configure KMS**.
4. On the **Configure KMS** dialog, select the KMS type to deploy: **HashiCorp Vault** or **Kmip**.

<div align="left"><img src="/files/ir8RgAwfL5X2qT40oe3j" alt="Configure KMS of HashiCorp Vault type"> <img src="/files/cw7RPxgpyWzxtqw2jEVQ" alt="Configure KMS of Kmpi type"></div>

5\. Enter the connection properties. The required properties depend on the KMS type you select.

For the **HashiCorp Vault** type, enter the following:

* **Address**: The KMS address
* **Key Identifier**: The identifier of the KMS.
* **Token**: The API token that you obtain from the vault.

For the **Kmip** type, enter the following:

* **Address**: The KMS address in hostname:port format.
* **KMS Identifier**: The identifier of the KMS.
* **Client Cert** and **Client Key**: The client certificate and key that you obtain for the Kmip-based KMS.
* **CA Cert**: (Optional) A digital certificate from the Certificate Authority (CA).

6\. Click **Save**.

**Related topics**

[Obtain an API token from the vault](/4.1/usage/security/kms-management/kms-management-1.md#obtain-an-api-token-from-the-vault)

[Obtain a certificate for a Kmip-based KMS](/4.1/usage/security/kms-management/kms-management-1.md#obtain-a-certificate-for-a-kmip-based-kms)

## View the KMS

**Procedure**

1. From the menu, select **Configure > Cluster Settings**.
2. From the left pane, select **Security**.
3. The **Security** page displays the configured KMS.

![View the configured KMS](/files/eBwscZVKkkTUpiE0gkIu)

## Update the KMS configuration

**Procedure**

1. From the menu, select **Configure > Cluster Settings**.
2. From the left pane, select **Security**.
3. The **Security** page displays the configured KMS.
4. Select **Update KMS**, and update its settings.

![Update the KMS](/files/Eauipo7Ev44PyvoApqzh)

5\. Select **Save**.

## Remove the KMS

Removing a KMS configuration is possible only if no encrypted filesystems exist.

**Procedure**

1. From the menu, select **Configure > Cluster Settings**.
2. From the left pane, select **Security**.
3. The **Security** page displays the configured KMS.
4. Select **Reset KMS.**
5. In the message that appears, select **Yes** to confirm the KMS configuration reset.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.weka.io/4.1/usage/security/kms-management/kms-management.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.