> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Pre-deployment checklist verifying environment requirements for OpenVPN Connect PKCS

Verify your environment meets these requirements.

## CryptoHub requirements

* A Futurex CryptoHub appliance (version `7.0.3.x` or later) with initial setup completed, including:
  * **Platform Master Key (PMK)** loaded
  * Network configuration set
  * Administrator access to the CryptoHub

## OpenVPN Connect v3 requirements

* OpenVPN Connect v3 application is installed on the Windows or macOS client device that will be used to connect to the OpenVPN Access Server.

### Supported Platforms

* macOS Catalina, Big Sur, Monterey, Ventura, Sonoma, and Sequoia
* Windows 10 and 11

## Network requirements

* Network connectivity from the OpenVPN Connect host to the CryptoHub:
  * Outbound TCP port **2001** (default Host API port) allowed.
  * Destination allowed by FQDN (e.g., `cryptohub.example.com`) or CIDR range.
  * CryptoHub FQDN exempt from TLS/SSL inspection or proxy filtering.

## Underlying responsibility roles

The PKCS #11 integration workflow involves three distinct roles that work together:

* **Access Server Admin:** Responsible for managing the OpenVPN Access Server, including creating client profiles, configuring server settings, and handles extracting certificates and generating PKCS #12 files.

* **CryptoHub Admin:** Responsible for managing the CryptoHub appliance, including deploying the OpenVPN Connect service, issuing and managing certificates and keys stored on the HSM, and configuring PKCS #11 settings. Could be the same person who is acting as the Access Server Admin depending on organizational structure.

* **OpenVPN Connect User:** Responsible for installing OpenVPN Connect, importing the client profile, and configuring the VPN connection with the hardware token on their device.

### Pages relevant to each role

* **CryptoHub Admin**:
  * [Deploy the service in CryptoHub](./Deploy_the_service_in_CryptoHub)
  * [Deploy a client endpoint](./Deploy_a_client_endpoint)
  * [Install and configure FxPKCS11 module on the client's device](./Install_and_configure_Futurex_PKCS_11)
  * [Import the client certificate and private key into the CryptoHub](./Import_the_client_certificate_and_private_key_into_the_CryptoHub)
* **Access Server Admin**:
  * [Create an RSA CA in the OpenVPN Access Server](./Create_an_RSA_CA_in_the_OpenVPN_Access_Server_Admin_Web_UI)
  * [Download a connection profile in the OpenVPN Access Server](./Download_the_client_connection_profile_\(.ovpn_file\))
  * [Edit the client profile](./Edit_the_Client_Profile)
* **OpenVPN Connect User**:
  * [Configure OpenVPN Connect to utilize the Futurex PKCS #11 hardware token](./Configure_OpenVPN_Connect_to_utilize_the_Futurex_PKCS_11_hardware_token)