> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure strongSwan to load the Futurex PKCS #11 module

> Register the Futurex PKCS #11 module with the charon and pki plugin stacks in strongswan.conf and enable charon debug logging.

Register the Futurex PKCS #11 module with both the charon daemon and the `pki` tool. charon needs it to authenticate tunnels; `pki` needs it to generate keys and sign certificates in the following steps.

## Edit /etc/strongswan.conf

```shell expandable lines wrap title="Shell" theme={null}
sudo cp /etc/strongswan.conf /etc/strongswan.conf.bak
sudo nano /etc/strongswan.conf
```

Use the following configuration:

```conf expandable lines wrap title="strongswan.conf" theme={null}
charon {
    load_modular = yes

    plugins {
        include strongswan.d/charon/*.conf

        pkcs11 {
            load = yes
            modules {
                futurex {
                    path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
                    os_locking = yes
                }
            }
        }
    }
}

pki {
    plugins {
        pkcs11 {
            load = yes
            modules {
                futurex {
                    path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
                    os_locking = yes
                }
            }
        }
    }
}

include strongswan.d/*.conf
```

<Warning>
  Do not set `load_modular = yes` inside the `pki` block. Doing so can prevent the default `pki` builders from loading, which causes certificate parsing failures in later steps.
</Warning>

The module name `futurex` is the handle you reference from `swanctl.conf` as `module = futurex`. If you change it here, change it there too.

## Enable charon debug logging

The verification steps in this guide read `/var/log/charon-debug.log`. charon does not write that file by default, so configure it:

```shell expandable lines wrap title="Shell" theme={null}
sudo tee /etc/strongswan.d/charon-logging.conf > /dev/null << 'EOF'
charon {
    filelog {
        charon-debug {
            path = /var/log/charon-debug.log
            time_format = %b %e %T
            append = yes
            default = 2
            flush_line = yes
        }
    }
}
EOF
```

<Note>
  Without this stanza, the `grep` commands in the following sections fail with `No such file or directory`, which reads as a failure of the integration rather than an absent log file.
</Note>

## Restart strongSwan and confirm the module loaded

```shell expandable lines wrap title="Shell" theme={null}
sudo systemctl daemon-reload
sudo systemctl restart strongswan-starter
sleep 8

sudo journalctl -u strongswan-starter --since "1 minute ago" --no-pager \
| grep -iE "pkcs|futurex"
```

<Check>
  The output shows the library loading, for example `loaded PKCS#11 v3.0 library 'futurex'`, followed by `Futurex: FxPKCS11 v6.1` and `plugin 'pkcs11': loaded successfully`.
</Check>

Confirm the token is visible:

```shell expandable lines wrap title="Shell" theme={null}
sudo grep -Ei "found token|plugin 'pkcs11'" /var/log/charon-debug.log | tail -5
```

<Check>
  A line reports `found token in slot 'futurex':0`.
</Check>

<Note>
  The message `module 'futurex' does not support hot-plugging, canceled` may appear. It means the module does not monitor for dynamic token insertion or removal. This message alone is not a blocker.
</Note>

<Note>
  The TPM plugin may report that it cannot load `libtss2-tcti-tabrmd.so.0`, followed by `plugin 'tpm': failed to load`. This is not a blocker for the PKCS #11 integration when TPM is not in use.
</Note>