Skip to main content
You can configure third-party applications to use the Futurex PKCS #11 (FXPKCS11) module through the Futurex Java Provider. All officially supported service integrations in CryptoHub contain detailed instructions. However, because the third-party application is unknown when using the Generic FXPKCS11 with Java Provider service, you must refer to the documentation made available by the third-party application for integrating it with a PKCS #11 module through Java. Contact the Futurex support team if you need us to add a specific third-party application to CryptoHub so our Integration Engineering team can add it to their roadmap.
Standalone keytool commands can load the SunPKCS11 provider from the command line using the -providerClass, -providerArg, and -providerName flags. Third-party applications that load the SunPKCS11 provider themselves, rather than accepting those flags on the command line, require the provider to be registered statically in java.security, as described in Configure SunPKCS11 to use the Futurex PKCS11 module. On systems running in FIPS mode, the JVM ignores security.provider.N entries; add the provider as a new fips.provider.N entry at the next free index instead.
In FIPS mode, do not repoint the existing fips.provider.1 line at your Futurex pkcs11.cfg. That line supplies the JVM’s only software digest implementations, because the SUN provider registers none under FIPS. Replacing it breaks SHA-384 and every other digest for all applications on that JDK. Append your entry at the next free index and keep the numbering contiguous, as described in Configure the provider in FIPS mode.