> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and configure CryptoHub CNG

> Install the endpoint-delivered CryptoHub Client Library CNG provider, configure cryptohub.json, and verify CryptoHub connectivity.

Install the endpoint-delivered **Futurex CryptoHub Key Storage Provider** on the Windows Server that hosts AD CS. Verify the provider against the CryptoHub backend before configuring the CA.

## Inspect the endpoint bundle

<Steps>
  <Step>
    Copy the endpoint zip to a directory on the Windows Server and extract it.
  </Step>

  <Step>
    Confirm that the extracted bundle contains these files:

    | File                | Purpose                                                                         |
    | ------------------- | ------------------------------------------------------------------------------- |
    | `cryptohub-cng.dll` | Windows CNG Key Storage Provider                                                |
    | `cng-install.exe`   | Provider installer and registration utility                                     |
    | `cng-uninstall.exe` | Provider removal utility                                                        |
    | `cng-manager.exe`   | CNG configuration and key-operation utility                                     |
    | `cryptohub.json`    | Pre-filled CryptoHub connection, service, authentication, and TLS configuration |
    | TLS files           | Trust and client material referenced by `cryptohub.json`                        |
  </Step>
</Steps>

## Copy the endpoint bundle files to one of the static search paths

The CNG provider searches the following static paths before it reads the `CHLIBS_CONFIG` environment variable:

1. `C:\Program Files\Futurex\cryptohub.json`
2. `C:\Program Files\Futurex\config\cryptohub.json`
3. `C:\Futurex\cryptohub.json`
4. `C:\Futurex\config\cryptohub.json`
5. The file specified by `CHLIBS_CONFIG`

<Check>
  Only one active `cryptohub.json` is present in the search path, and its `cng.provider_name` is **Futurex CryptoHub Key Storage Provider**.
</Check>

For the complete field reference, see [CryptoHub CNG configuration](/Drivers_and_libraries/CryptoHub_CNG_developer_guide/Configuration).

## Register the provider

<Steps>
  <Step>
    Open PowerShell as an administrator in the extracted endpoint directory.
  </Step>

  <Step>
    Register the provider. Use `-overwrite` when replacing an earlier CryptoHub CNG build:

    ```powershell theme={null}
    .\cng-install.exe -overwrite
    ```

    Approve the Windows elevation prompt if it appears.
  </Step>

  <Step>
    Confirm that Windows registered the expected provider:

    ```powershell theme={null}
    certutil -csplist |
      Select-String "Futurex CryptoHub Key Storage Provider"
    ```

    <Check>
      The output includes **Futurex CryptoHub Key Storage Provider**.
    </Check>
  </Step>
</Steps>

## Verify the CryptoHub backend

Provider registration alone does not prove that the provider can authenticate to CryptoHub. Run a backend key-enumeration operation:

```powershell theme={null}
certutil -key -csp "Futurex CryptoHub Key Storage Provider"
```

The command must complete without a provider, configuration, TLS, or authentication error. An empty key list is valid before AD CS creates the subordinate CA key.

<Warning>
  Do not use `certutil -csptest` as the only connection test. It can succeed after local provider registration without proving a privileged operation against CryptoHub.
</Warning>

You can also open `cng-manager.exe` and enumerate the keys visible through the configured service.

Continue to [Configure the ML-DSA subordinate CA](./configure-ml-dsa-subordinate-ca).