Install and configure Futurex PKCS #11

Extract the endpoint ZIP and install the complete unit:

sudo install -d -m 700 /etc/futurex-pkcs11
sudo install -m 755 libcryptohub-pkcs11.so \
  /usr/local/lib/libcryptohub-pkcs11.so
sudo install -m 755 pkcs11-manager /usr/local/bin/pkcs11-manager
sudo cp -- *.crt *.pem *.p12 cryptohub.json /etc/futurex-pkcs11/
sudo chown -R root:root /etc/futurex-pkcs11
sudo chmod 600 /etc/futurex-pkcs11/*

Set CHLIBS_CONFIG=/etc/futurex-pkcs11/cryptohub.json in the real application process. Keep every referenced TLS file beside the configuration and keep TLS verification enabled.

Config-carried mode

Use this mode only when the application suppresses C_Login. Keep the endpoint username and password in cryptohub.json. Do not configure a PIN source.

PIN-carried mode

Use this mode when the application calls C_Login:

ENDPOINT_PASSWORD="$(sudo jq -r '.authentication.users[0].password' \
  /etc/futurex-pkcs11/cryptohub.json)"
printf '%s\n' "$ENDPOINT_PASSWORD" \
  | sudo install -m 600 -o root -g root /dev/stdin \
      /etc/futurex-pkcs11/token-pin
sudo jq '
  .authentication.users |= map({username}) |
  .pkcs11.check_already_logged_in = true
' /etc/futurex-pkcs11/cryptohub.json \
  | sudo install -m 600 -o root -g root /dev/stdin \
      /etc/futurex-pkcs11/cryptohub.json.new
sudo mv /etc/futurex-pkcs11/cryptohub.json.new \
  /etc/futurex-pkcs11/cryptohub.json
unset ENDPOINT_PASSWORD

Do not combine the modes. A config-carried password plus consumer C_Login can produce CKR_USER_ALREADY_LOGGED_IN.

Verify the module:

sudo env CHLIBS_CONFIG=/etc/futurex-pkcs11/cryptohub.json \
  pkcs11-tool \
  --module /usr/local/lib/libcryptohub-pkcs11.so \
  --list-token-slots

The output lists the Futurex token in slot 0.

​Config-carried mode

​PIN-carried mode

Config-carried mode

PIN-carried mode