Skip to main content
Verify your environment meets these requirements.

​
Supported hardware

  • CryptoHub, 7.0.3.x or later.
This guide uses the Futurex PKCS #11 (FXPKCS11) module that CryptoHub 7.0.3.x delivers in the endpoint ZIP.

​
Supported operating systems

  • Windows
The Certificate Manager host and the computer where you run hwsetup must both load the Windows FXPKCS11 library (fxpkcs11.dll). In most deployments they are the same computer.

​
Required access

  • An account on the CryptoHub with administrator permissions to deploy new services.
  • Local administrator access on the Certificate Manager host, to install FXPKCS11 under C:\Program Files and set machine-wide environment variables.
  • Two Certificate Manager administration officers with the Use AWB and CA and Key tasks roles. Certificate Manager requires two officers to sign the CA key and CA creation tasks.

​
Network and firewall

  • Allow outbound TCP port 2001 (default Host API port) from the Certificate Manager host to the CryptoHub, specified by FQDN (for example, cryptohub.example.com) or CIDR (for example, 10.0.0.0/24). FXPKCS11 carries every key generation and signing request over this port.
TLS inspection or SSL proxies can break mutual TLS handshakes. FXPKCS11 authenticates to CryptoHub with a client certificate, and an inspecting proxy replaces the server certificate the module expects. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.

​
Required software

Run hwsetup.bat from Command Prompt, not PowerShell. A PKCS #11 PIN that contains & breaks when PowerShell passes it to a batch file. See Troubleshooting.
The Nexus tool package uses the following layout. hwsetup.bat expects to find the bridge library and the Java libraries relative to its own directory, so keep the structure intact:
Folder structure