Skip to main content
Install Futurex PKCS #11 (FXPKCS11) on the Windows host that runs Certificate Manager and hwsetup.
1
Extract the endpoint ZIP file you downloaded after deploying the client endpoint. The ZIP file contains the following files:
2
As an administrator, create the C:\Program Files\Futurex\fxpkcs11 directory and move all of the preceding files into it.Every hwsetup command in this guide loads the library from C:\Program Files\Futurex\fxpkcs11\fxpkcs11.dll.
3
Keep fxpkcs11.cfg in the same directory.The module looks for fxpkcs11.cfg in C:\Program Files\Futurex\fxpkcs11 by default. If you store the configuration elsewhere, set the FXPKCS11_CFG environment variable to the full path of the configuration file. The TLS files that the configuration references must stay in the same directory as fxpkcs11.cfg.
4
Record the PKCS #11 PIN.
  • Find the PIN in the CRYPTO-OPR-PASS setting inside fxpkcs11.cfg.
  • Copy the PIN to a secure location. You pass it to hwsetup and configure it in Certificate Manager in later steps.
  • Comment out the CRYPTO-OPR-PASS line, so the PIN is supplied only by the application that logs in:
fxpkcs11.cfg
If the PIN contains &, run every hwsetup command in this guide from Command Prompt and wrap the PIN in double quotes. PowerShell does not pass & to a batch file intact.
5
Move the PKCS #12 password to an environment variable.
  • Find the password in the PROD-TLS-KEY-PASS setting inside fxpkcs11.cfg.
  • Copy the password, then replace the value in fxpkcs11.cfg with env:PKCS11_P12.
  • Set the machine-wide environment variable in an elevated Command Prompt (Run as Administrator):
Command Prompt
Replace your-p12-password with the password you copied.
Newly set environment variables are visible only to new processes. Close and reopen Command Prompt, and restart the Certificate Manager services, before you run anything that relies on PKCS11_P12.
6
Locate the logs.
  • The default FXPKCS11 log location is C:\Program Files\Futurex\fxpkcs11.
  • To change it, modify the LOG-FILE setting in fxpkcs11.cfg.
7
Validate the configuration and connection.Open a new Command Prompt and run configTest.exe from C:\Program Files\Futurex\fxpkcs11:
Command Prompt
The connection test succeeds. If it fails, read the FXPKCS11 log file and confirm the PKCS #12 password and TLS files are in the expected locations.
8
Validate PKCS #11 operations.Run PKCS11Manager.exe from the same directory, log in with the PKCS #11 PIN, and perform a simple action such as generating random data.
The login succeeds and the action returns a result. If authentication fails, confirm the PIN. To reset it, go to Identity and Access > Applications & Partitions, find the application you deployed, and select [ Authentication ] in the Manage section.