Skip to main content
Verify your environment meets these requirements.

​
Supported hardware

  • CryptoHub, 7.0.3.x or later.

​
Supported operating systems

  • Linux
The validated platform for this guide is Ubuntu 24.04 LTS on x86_64 with OpenSSL 3.0.13 and strongSwan 5.9.13.
The AppArmor step later in this guide is Ubuntu-specific. On an SELinux distribution, grant charon equivalent access to the Futurex library and configuration paths. This guide does not provide an SELinux policy.

​
Required access

  • An account on the CryptoHub with administrator permissions to deploy new services and edit endpoint roles.
  • Local root or sudo access on the Linux hosts running strongSwan.

​
Network and firewall

  • Allow outbound TCP port 2001 (default Host API port) from the strongSwan host to the CryptoHub, specified by FQDN (for example, cryptohub.example.com) or CIDR (for example, 10.0.0.0/24).
  • Allow UDP 500 and UDP 4500 between the IPsec peers for IKE and NAT traversal.
TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.

​
CryptoHub endpoint role permissions

The endpoint role must hold these permissions. On CryptoHub 7.0.3.x, asymmetric key creation is authorized under the CertManage permission family, not under Keys. Granting only Keys:Add authorizes symmetric key creation and nothing else.
If any of the three CertManage permissions is missing, key generation fails with a misleading client-side error, CKR_TEMPLATE_INCONSISTENT, that does not name the missing permission. If the two export permissions are missing, pkcs11-tool --list-objects returns empty output with no error, which looks like the key was never created even though it exists on the appliance. To review the role, go to Identity and Access, open the Roles tab, and edit the role belonging to the endpoint you deploy in the next section.

​
Required software

  • Futurex PKCS #11 (FXPKCS11) 6.1 or later. The endpoint zip you download in Deploy client endpoint supplies the module, so you cannot check the version yet. Confirm it at runtime rather than from info.txt, which is not reliable for this library family. The check is in Install and configure Futurex PKCS #11.
  • strongSwan 5.9 or later, with the PKCS #11 and VICI plugins and the pki tool. On Ubuntu 24.04, these are spread across four packages:
Shell
Do not assume a stock strongSwan installation is sufficient. libstrongswan-pkcs11.so ships only in libstrongswan-extra-plugins, and the ipsec pki subcommand ships only in strongswan-pki. Without the first, charon cannot load the Futurex module at all. Without the second, ipsec pki reports unknown command 'pki' even though ipsec --help lists it.

​
Other

  • pkcs11-tool (from opensc or opensc-pkcs11)
  • OpenSSL
  • unzip

​
Validated toolchain

The following versions were validated end to end for this guide. Later releases in the same series are expected to work, but these are the versions the documented commands and output were confirmed against.

​
Verify the strongSwan installation

Shell
ipsec pki --help prints the pki usage banner rather than unknown command, and the plugin listing shows both libstrongswan-pkcs11.so and libstrongswan-vici.so. If either plugin is absent, install the package noted above before continuing.

​
Files in the endpoint zip

The endpoint zip you download in the next section contains the Futurex PKCS #11 module, its configuration file, and the TLS material the module needs to reach the appliance.
The CryptoHub CA certificate in the zip is named for your appliance’s own serial number, so the file name differs on every appliance. Expect a file such as CryptoHub 1234567890.cer, and substitute your own file name wherever this guide refers to CryptoHub <serial>.cer. The companion root certificate is either Futurex Test Root CA (ECC).cer or Futurex Test Root SSL CA.cer depending on the algorithm configured for the Host API connection pair; only one is included.