> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Checklist of environment prerequisites and requirements before integrating Nexus PKI with CryptoHub.

Verify your environment meets these requirements.

## Supported hardware

* CryptoHub, `7.0.3.x` or later.

This guide uses the Futurex PKCS #11 (FXPKCS11) module that CryptoHub `7.0.3.x` delivers in the endpoint ZIP.

## Supported operating systems

* Windows

The Certificate Manager host and the computer where you run `hwsetup` must both load the Windows FXPKCS11 library (`fxpkcs11.dll`). In most deployments they are the same computer.

## Required access

* An account on the CryptoHub with administrator permissions to deploy new services.
* Local administrator access on the Certificate Manager host, to install FXPKCS11 under `C:\Program Files` and set machine-wide environment variables.
* Two Certificate Manager administration officers with the **Use AWB** and **CA and Key tasks** roles. Certificate Manager requires two officers to sign the CA key and CA creation tasks.

## Network and firewall

* Allow outbound TCP port **2001** (default Host API port) from the Certificate Manager host to the CryptoHub, specified by FQDN (for example, `cryptohub.example.com`) or CIDR (for example, `10.0.0.0/24`). FXPKCS11 carries every key generation and signing request over this port.

<Warning>
  TLS inspection or SSL proxies can break mutual TLS handshakes. FXPKCS11 authenticates to CryptoHub with a client certificate, and an inspecting proxy replaces the server certificate the module expects. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.
</Warning>

## Required software

| Component | Requirement |
| - | - |
| Nexus Smart ID Certificate Manager | Installed and running. This guide does not cover its installation. |
| `hwsetup` | The key setup tool included with Certificate Manager, in the `tools` directory of the installation. |
| Nexus PKCS #11 bridge | `jpkcs11.dll`, the 64-bit Nexus native PKCS #11 wrapper that `hwsetup` and Certificate Manager use to load a PKCS #11 library. |
| Java | Java 21, 64-bit, for `hwsetup`. |
| Futurex PKCS #11 | `fxpkcs11.dll`, delivered in the CryptoHub endpoint ZIP. |
| Command shell | Windows Command Prompt (`cmd.exe`). |

<Note>
  Run `hwsetup.bat` from Command Prompt, not PowerShell. A PKCS #11 PIN that contains `&` breaks when PowerShell passes it to a batch file. See [Troubleshooting](/Integrations/CryptoHub/Certificate_Authority/Nexus_PKI/Troubleshooting).
</Note>

The Nexus tool package uses the following layout. `hwsetup.bat` expects to find the bridge library and the Java libraries relative to its own directory, so keep the structure intact:

```text expandable lines wrap title="Folder structure" theme={null}
Tools
├── bin
│   └── jpkcs11.dll
├── lib
│   └── *.jar
└── tools
    └── hwsetup.bat
```