Skip to main content
Verify your environment meets these requirements.

​
Supported hardware

  • CryptoHub, 7.0.3.x or later.
This guide uses the Futurex PKCS #11 (FXPKCS11) module that CryptoHub 7.0.3.x delivers in the endpoint ZIP for the OpenSUSE 15.0 platform.

​
Supported operating systems

  • SUSE Linux Enterprise Server 15 or openSUSE Leap 15 on x86-64

​
Supported SAP ASE versions

  • SAP Adaptive Server Enterprise 16.0 SP04 running the threaded kernel, with the ASE_ENCRYPTION option licensed
SAP ASE supports an external keystore only in threaded kernel mode.

​
Required access

  • An account on the CryptoHub with administrator permissions to deploy new services.
  • Root access on the SAP ASE host, to install the module and its configuration.
  • The operating system account that runs SAP ASE (this guide uses sybase) and the $SYBASE installation directory (this guide uses /opt/sap).
  • An SAP ASE login with sso_role and keycustodian_role, or with the manage security configuration and manage master key permissions when granular permissions are enabled.

​
Network and firewall

  • Allow outbound TCP port 2001 (default Host API port) from the SAP ASE host to the CryptoHub, specified by FQDN (for example, cryptohub.example.com) or CIDR (for example, 10.0.0.0/24). FXPKCS11 carries every key operation over this port.
TLS inspection or SSL proxies can break mutual TLS handshakes. FXPKCS11 authenticates to CryptoHub with a client certificate, and an inspecting proxy replaces the server certificate the module expects. Exempt the CryptoHub FQDN from inspection.

​
Plan for availability

SAP ASE decrypts every HSM-protected master key through CryptoHub when it starts. If CryptoHub is unreachable or the stored credential is wrong, fully encrypted databases stay offline until CryptoHub is reachable again and you bring them online. Keep a password-protected export of each master key, as described in the SAP ASE Database Encryption guide, before you encrypt production data.