Before you start - Futurex Documentation

Complete these prerequisites before you deploy the integration.

Software and platform

Use CryptoHub 7.3.0.x build 7.3.0.0b or later. This guide uses the REST-based CryptoHub Client Library rather than the legacy Host API library.
Use Ubuntu 24.04 with strongSwan 5.9.13 or a compatible release. Package names and AppArmor paths differ on other distributions.
Install strongswan, strongswan-swanctl, strongswan-pki, and libstrongswan-extra-plugins. The extra-plugins package provides libstrongswan-pkcs11.so.
Install opensc for pkcs11-tool verification.

Run:

sudo apt update
sudo apt install strongswan strongswan-swanctl strongswan-pki \
  libstrongswan-extra-plugins opensc openssl

Run ipsec --version, swanctl --version, and test -f /usr/lib/ipsec/plugins/libstrongswan-pkcs11.so. Each command must succeed.

Allow the strongSwan gateway to reach CryptoHub over TCP 443. FxChlibs sends authentication and signing requests over this connection.
Allow IKEv2 between the gateways over UDP 500 and UDP 4500. Permit ESP when the peers do not use UDP encapsulation.
Exempt the CryptoHub TLS connection from interception. The endpoint bundle pins the trust material that authenticates CryptoHub.

Verify CryptoHub reachability:

curl --fail --silent --show-error https://<CRYPTOHUB_HOST>/home/v1/status

Replace <CRYPTOHUB_HOST> with the CryptoHub hostname. The command must return a status document.

Obtain two CryptoHub administrator identities. Dual control protects service and endpoint deployment.

This guide was validated on Ubuntu 24.04 with strongSwan 5.9.13. It does not provide RHEL package names or SELinux policy.