Validate charon can load the HSM-backed private key

Before configuring a tunnel, confirm charon can reach the CryptoHub-resident private key through the Futurex module. This isolates the HSM integration from any later connection-configuration problem.

Install the certificates

Shell

sudo mkdir -p /etc/swanctl/x509 /etc/swanctl/x509ca

sudo cp ~/strongswan-certs/strongswan-cert.pem /etc/swanctl/x509/strongswan-cert.pem
sudo cp ~/strongswan-certs/strongswanCert.pem /etc/swanctl/x509ca/strongswanCert.pem

sudo chmod 644 /etc/swanctl/x509/strongswan-cert.pem
sudo chmod 644 /etc/swanctl/x509ca/strongswanCert.pem

Create a credential-only swanctl.conf

This configuration has no connections. It loads the token credential and nothing else.

Shell

sudo tee /etc/swanctl/swanctl.conf > /dev/null << 'EOF'
connections {
}

secrets {
    token-strongswan {
        module = futurex
        handle = 02
        pin = "REPLACE_WITH_PKCS11_PIN"
    }
}
EOF

sudo chmod 600 /etc/swanctl/swanctl.conf
sudo chown root:root /etc/swanctl/swanctl.conf

Replace REPLACE_WITH_PKCS11_PIN with the PKCS #11 PIN you copied from the CRYPTO-OPR-PASS parameter in fxpkcs11.cfg.

This file now contains the PKCS #11 PIN in cleartext. Set the mode to 600 and owner to root:root as shown above, and exclude the file from configuration backups that are not themselves protected.

The fields map to the objects you created:

module = futurex — the module name registered in strongswan.conf.
handle = 02 — the object ID of the responder private key.
pin — the PKCS #11 PIN for the endpoint.

Load the credentials

Shell

sudo systemctl daemon-reload
sudo systemctl restart strongswan-starter
sleep 8

sudo swanctl --load-creds --raw

The output includes load-token reply {success=yes id=...} along with load-cert reply {success=yes} for each certificate.

If the reply is success=no with loading private key from token failed, charon reached the module but could not use the key. See Troubleshooting.

Confirm with the charon log

Shell

sudo grep -Ei 'load-token|found key|loaded RSA private key|pkcs11' /var/log/charon-debug.log | tail -20

The log shows the following sequence:

loaded PKCS#11 v3.0 library 'futurex' (/usr/local/lib/fxpkcs11/libfxpkcs11.so)
  Futurex: FxPKCS11 v6.1
plugin 'pkcs11': loaded successfully
vici client 1 requests: load-token
found key on PKCS#11 token 'futurex':0
loaded RSA private key from token

loaded RSA private key from token is the confirmation that charon can authenticate with a key that never leaves the CryptoHub.

​Install the certificates

​Create a credential-only swanctl.conf

​Load the credentials

​Confirm with the charon log

Install the certificates

Create a credential-only swanctl.conf

Load the credentials

Confirm with the charon log