> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Checklist of environment prerequisites, required packages, and CryptoHub role permissions before integrating strongSwan with CryptoHub.

Verify your environment meets these requirements.

## Supported hardware

* CryptoHub, `7.0.3.x` or later.

## Supported operating systems

* Linux

The validated platform for this guide is Ubuntu 24.04 LTS on x86\_64 with OpenSSL 3.0.13 and strongSwan 5.9.13.

<Note>
  The AppArmor step later in this guide is Ubuntu-specific. On an SELinux distribution, grant charon equivalent access to the Futurex library and configuration paths. This guide does not provide an SELinux policy.
</Note>

## Required access

* An account on the CryptoHub with administrator permissions to deploy new services and edit endpoint roles.
* Local root or `sudo` access on the Linux hosts running strongSwan.

## Network and firewall

* Allow outbound TCP port **2001** (default Host API port) from the strongSwan host to the CryptoHub, specified by FQDN (for example, `cryptohub.example.com`) or CIDR (for example, `10.0.0.0/24`).
* Allow UDP **500** and UDP **4500** between the IPsec peers for IKE and NAT traversal.

<Warning>
  TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.
</Warning>

## CryptoHub endpoint role permissions

<Warning>
  The endpoint role must hold these permissions. On CryptoHub `7.0.3.x`, asymmetric key creation is authorized under the **CertManage** permission family, not under **Keys**. Granting only `Keys:Add` authorizes symmetric key creation and nothing else.
</Warning>

| Permission                      | Why it is required                                                                  |
| ------------------------------- | ----------------------------------------------------------------------------------- |
| `CertManage:Add`                | Creating the RSA key pairs in the CryptoHub. Without it, key generation is refused. |
| `CertManage:Export`             | Enumerating token objects, which strongSwan and `pkcs11-tool` both do before use.   |
| `CertManage:Export Private Key` | Also required to enumerate token objects. No private key material is exported.      |
| `Crypto:Sign`                   | Signing the CA certificate, the peer certificates, and the IKE\_AUTH payload.       |
| `Crypto:Verify`                 | Verifying issued certificates and validating the peer certificate during IKE.       |
| `Keys:Add`                      | Included in the validated grant for this integration.                               |

If any of the three `CertManage` permissions is missing, key generation fails with a misleading client-side error, `CKR_TEMPLATE_INCONSISTENT`, that does not name the missing permission. If the two export permissions are missing, `pkcs11-tool --list-objects` returns **empty output with no error**, which looks like the key was never created even though it exists on the appliance.

To review the role, go to **Identity and Access**, open the **Roles** tab, and edit the role belonging to the endpoint you deploy in the next section.

## Required software

* **Futurex PKCS #11 (FXPKCS11) 6.1 or later.** The endpoint zip you download in [Deploy client endpoint](/Integrations/CryptoHub/VPN/strongSwan/Deploy_client_endpoint) supplies the module, so you cannot check the version yet. Confirm it at runtime rather than from `info.txt`, which is not reliable for this library family. The check is in [Install and configure Futurex PKCS #11](/Integrations/CryptoHub/VPN/strongSwan/Install_and_configure_Futurex_PKCS_11).
* **strongSwan 5.9 or later**, with the PKCS #11 and VICI plugins and the `pki` tool. On Ubuntu 24.04, these are spread across four packages:

```shell expandable lines wrap title="Shell" theme={null}
sudo apt update
sudo apt install strongswan strongswan-swanctl strongswan-pki libstrongswan-extra-plugins
```

<Warning>
  Do not assume a stock strongSwan installation is sufficient. `libstrongswan-pkcs11.so` ships **only** in `libstrongswan-extra-plugins`, and the `ipsec pki` subcommand ships **only** in `strongswan-pki`. Without the first, charon cannot load the Futurex module at all. Without the second, `ipsec pki` reports `unknown command 'pki'` even though `ipsec --help` lists it.
</Warning>

## Other

* `pkcs11-tool` (from `opensc` or `opensc-pkcs11`)
* OpenSSL
* `unzip`

## Validated toolchain

The following versions were validated end to end for this guide. Later releases in the same series are expected to work, but these are the versions the documented commands and output were confirmed against.

| Component                   | Validated version           |
| --------------------------- | --------------------------- |
| CryptoHub                   | `7.0.3.24b`                 |
| Futurex PKCS #11 (FXPKCS11) | `6.1`                       |
| strongSwan                  | `5.9.13`                    |
| OpenSSL                     | `3.0.13`                    |
| Operating system            | Ubuntu 24.04.4 LTS, x86\_64 |

## Verify the strongSwan installation

```shell expandable lines wrap title="Shell" theme={null}
ipsec version
swanctl --version
ipsec pki --help
ls /usr/lib/ipsec/plugins | grep -E 'pkcs11|vici'
```

<Check>
  `ipsec pki --help` prints the `pki` usage banner rather than `unknown command`, and the plugin listing shows both `libstrongswan-pkcs11.so` and `libstrongswan-vici.so`. If either plugin is absent, install the package noted above before continuing.
</Check>

## Files in the endpoint zip

The endpoint zip you download in the next section contains the Futurex PKCS #11 module, its configuration file, and the TLS material the module needs to reach the appliance.

<Note>
  The CryptoHub CA certificate in the zip is named for your appliance's own serial number, so the file name differs on every appliance. Expect a file such as `CryptoHub 1234567890.cer`, and substitute your own file name wherever this guide refers to `CryptoHub <serial>.cer`. The companion root certificate is either `Futurex Test Root CA (ECC).cer` or `Futurex Test Root SSL CA.cer` depending on the algorithm configured for the Host API connection pair; only one is included.
</Note>