Configure strongSwan to load the Futurex PKCS #11 module

Register the Futurex PKCS #11 module with both the charon daemon and the pki tool. charon needs it to authenticate tunnels; pki needs it to generate keys and sign certificates in the following steps.

Edit /etc/strongswan.conf

Shell

sudo cp /etc/strongswan.conf /etc/strongswan.conf.bak
sudo nano /etc/strongswan.conf

Use the following configuration:

strongswan.conf

charon {
    load_modular = yes

    plugins {
        include strongswan.d/charon/*.conf

        pkcs11 {
            load = yes
            modules {
                futurex {
                    path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
                    os_locking = yes
                }
            }
        }
    }
}

pki {
    plugins {
        pkcs11 {
            load = yes
            modules {
                futurex {
                    path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
                    os_locking = yes
                }
            }
        }
    }
}

include strongswan.d/*.conf

Do not set load_modular = yes inside the pki block. Doing so can prevent the default pki builders from loading, which causes certificate parsing failures in later steps.

The module name futurex is the handle you reference from swanctl.conf as module = futurex. If you change it here, change it there too.

Enable charon debug logging

The verification steps in this guide read /var/log/charon-debug.log. charon does not write that file by default, so configure it:

Shell

sudo tee /etc/strongswan.d/charon-logging.conf > /dev/null << 'EOF'
charon {
    filelog {
        charon-debug {
            path = /var/log/charon-debug.log
            time_format = %b %e %T
            append = yes
            default = 2
            flush_line = yes
        }
    }
}
EOF

Without this stanza, the grep commands in the following sections fail with No such file or directory, which reads as a failure of the integration rather than an absent log file.

Restart strongSwan and confirm the module loaded

Shell

sudo systemctl daemon-reload
sudo systemctl restart strongswan-starter
sleep 8

sudo journalctl -u strongswan-starter --since "1 minute ago" --no-pager \
| grep -iE "pkcs|futurex"

The output shows the library loading, for example loaded PKCS#11 v3.0 library 'futurex', followed by Futurex: FxPKCS11 v6.1 and plugin 'pkcs11': loaded successfully.

Confirm the token is visible:

Shell

sudo grep -Ei "found token|plugin 'pkcs11'" /var/log/charon-debug.log | tail -5

A line reports found token in slot 'futurex':0.

The message module 'futurex' does not support hot-plugging, canceled may appear. It means the module does not monitor for dynamic token insertion or removal. This message alone is not a blocker.

The TPM plugin may report that it cannot load libtss2-tcti-tabrmd.so.0, followed by plugin 'tpm': failed to load. This is not a blocker for the PKCS #11 integration when TPM is not in use.

​Edit /etc/strongswan.conf

​Enable charon debug logging

​Restart strongSwan and confirm the module loaded

Edit /etc/strongswan.conf

Enable charon debug logging

Restart strongSwan and confirm the module loaded