Skip to main content
The CryptoHub-backed PKCS#11 module lets applications perform cryptographic operations against CryptoHub-managed keys through the standard PKCS#11 (Cryptoki) API. Instead of connecting directly to an HSM, the module talks to one or more CryptoHub appliances over a REST/TLS connection and presents the keys in a CryptoHub service and key store as PKCS#11 objects. The module reports Cryptoki version 3.2 and implements the PKCS#11 v3.2 key encapsulation interface, so it exposes post-quantum ML-DSA and ML-KEM operations alongside classical RSA, ECC, and symmetric mechanisms.
This guide documents the CryptoHub-backed module (libcryptohub-pkcs11.*, configured with cryptohub.json). It is a different provider from the legacy Futurex PKCS#11 module (fxpkcs11 / libfxpkcs11.so, configured with the XML-based fxpkcs11.cfg), which connects directly to an HSM and is documented in the PKCS#11 developer guide. Choose the guide that matches the library you installed.

​
Choosing between the CryptoHub-backed and legacy PKCS#11 modules

Both modules expose the same PKCS#11 API to your application, but they connect to Futurex infrastructure in different ways and are configured differently. Futurex recommends the CryptoHub-backed module for new deployments that use CryptoHub, and for any application that needs post-quantum mechanisms.
AspectCryptoHub-backed moduleLegacy fxpkcs11 module
Librarycryptohub-pkcs11.dll, libcryptohub-pkcs11.so, libcryptohub-pkcs11.dyliblibfxpkcs11.so, fxpkcs11.dll
Configuration filecryptohub.json (JSON)fxpkcs11.cfg (XML-like tags)
ConnectionOne or more CryptoHub REST base URIs over TLSDirect HSM host and port
Key locationCryptoHub service and key storeHSM token
AuthenticationCryptoHub user credentials, API key, PKI nonce-signature, or mutual TLSHSM operator credentials and direct-HSM TLS
Cryptoki version3.2 (includes PKCS#11 v3.2 KEM)3.0
Post-quantum supportML-DSA and ML-KEMNot exposed

​
What the endpoint download includes

The CryptoHub-backed module ships inside the endpoint download, not as a standalone package. You deploy a CryptoHub Client Library service, add an endpoint to it, and download a zip file that contains the provider library for the platform you selected, a pre-filled cryptohub.json and TLS material for that endpoint, and command-line tools for exercising and configuring the module. See Installation for the full workflow.
ItemPurpose
cryptohub-pkcs11.dll / libcryptohub-pkcs11.so / libcryptohub-pkcs11.dylibThe PKCS#11 provider library. Point your application’s PKCS#11 module path at this file.
pkcs11-managerInteractive utility for initializing the module, logging in, listing slots and mechanisms, enumerating objects, generating keys, and running cryptographic operations.
fxchlCommand-line client for CryptoHub Client Library operations, used to verify connectivity and authentication.
config-translatorHelper for producing a cryptohub.json configuration.
cryptohub.jsonYour deployment configuration for this endpoint, pre-filled with the connection, authentication, and TLS settings.
TLS materialThe CA and client TLS files the module uses to establish, and for mutual TLS to authenticate, the connection to CryptoHub.

​
Supported platforms

The module ships as a native library for each supported platform. Package names and library extensions vary by platform.
PlatformProvider library
Windowscryptohub-pkcs11.dll
Linux and other POSIX systemslibcryptohub-pkcs11.so
macOS (including ARM64)libcryptohub-pkcs11.dylib

​
Version reference

The following table records the module identifiers this guide documents. Because advertised mechanisms and key-size limits can change between CryptoHub releases, treat the mechanism appendix as a snapshot and verify against your own installation.
PropertyValue
Library-reported manufacturerFuturex
Library-reported descriptionCryptoHub PKCS11
Cryptoki version3.2
Backend validated againstCryptoHub 7.3

​
Documentation structure

This guide walks you through installing, configuring, and using the CryptoHub-backed PKCS#11 module.
  • Installation: Install the provider library for your platform and verify it with pkcs11-manager.
  • Configuration: Configure cryptohub.json, including connection, authentication, TLS, and key usage policy.
  • Architecture: Understand how the module maps CryptoHub services, key stores, and protection models onto PKCS#11 slots, tokens, and objects.
  • Post-quantum cryptography: Generate and use ML-DSA and ML-KEM keys through the PKCS#11 v3.2 interface.
  • Troubleshooting: Diagnose configuration, connectivity, authentication, and compatibility problems.
  • Appendix A: Reference the mechanisms the module advertises at runtime.