Skip to main content
Install the endpoint-delivered Futurex CryptoHub Key Storage Provider on the Windows Server that hosts AD CS. Verify the provider against the CryptoHub backend before configuring the CA.

​
Inspect the endpoint bundle

1
Copy the endpoint zip to a directory on the Windows Server and extract it.
2
Confirm that the extracted bundle contains these files:

​
Copy the endpoint bundle files to one of the static search paths

The CNG provider searches the following static paths before it reads the CHLIBS_CONFIG environment variable:
  1. C:\Program Files\Futurex\cryptohub.json
  2. C:\Program Files\Futurex\config\cryptohub.json
  3. C:\Futurex\cryptohub.json
  4. C:\Futurex\config\cryptohub.json
  5. The file specified by CHLIBS_CONFIG
Only one active cryptohub.json is present in the search path, and its cng.provider_name is Futurex CryptoHub Key Storage Provider.
For the complete field reference, see CryptoHub CNG configuration.

​
Register the provider

1
Open PowerShell as an administrator in the extracted endpoint directory.
2
Register the provider. Use -overwrite when replacing an earlier CryptoHub CNG build:
Approve the Windows elevation prompt if it appears.
3
Confirm that Windows registered the expected provider:
The output includes Futurex CryptoHub Key Storage Provider.

​
Verify the CryptoHub backend

Provider registration alone does not prove that the provider can authenticate to CryptoHub. Run a backend key-enumeration operation:
The command must complete without a provider, configuration, TLS, or authentication error. An empty key list is valid before AD CS creates the subordinate CA key.
Do not use certutil -csptest as the only connection test. It can succeed after local provider registration without proving a privileged operation against CryptoHub.
You can also open cng-manager.exe and enumerate the keys visible through the configured service. Continue to Configure the ML-DSA subordinate CA.