> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate charon can load the HSM-backed private key

> Load the responder certificate and the CryptoHub token credential into charon and confirm the load-token reply reports success.

Before configuring a tunnel, confirm charon can reach the CryptoHub-resident private key through the Futurex module. This isolates the HSM integration from any later connection-configuration problem.

## Install the certificates

```shell expandable lines wrap title="Shell" theme={null}
sudo mkdir -p /etc/swanctl/x509 /etc/swanctl/x509ca

sudo cp ~/strongswan-certs/strongswan-cert.pem /etc/swanctl/x509/strongswan-cert.pem
sudo cp ~/strongswan-certs/strongswanCert.pem /etc/swanctl/x509ca/strongswanCert.pem

sudo chmod 644 /etc/swanctl/x509/strongswan-cert.pem
sudo chmod 644 /etc/swanctl/x509ca/strongswanCert.pem
```

## Create a credential-only swanctl.conf

This configuration has no connections. It loads the token credential and nothing else.

```shell expandable lines wrap title="Shell" theme={null}
sudo tee /etc/swanctl/swanctl.conf > /dev/null << 'EOF'
connections {
}

secrets {
    token-strongswan {
        module = futurex
        handle = 02
        pin = "REPLACE_WITH_PKCS11_PIN"
    }
}
EOF

sudo chmod 600 /etc/swanctl/swanctl.conf
sudo chown root:root /etc/swanctl/swanctl.conf
```

Replace `REPLACE_WITH_PKCS11_PIN` with the PKCS #11 PIN you copied from the `CRYPTO-OPR-PASS` parameter in `fxpkcs11.cfg`.

<Warning>
  This file now contains the PKCS #11 PIN in cleartext. Set the mode to `600` and owner to `root:root` as shown above, and exclude the file from configuration backups that are not themselves protected.
</Warning>

The fields map to the objects you created:

* `module = futurex` — the module name registered in `strongswan.conf`.
* `handle = 02` — the object ID of the responder private key.
* `pin` — the PKCS #11 PIN for the endpoint.

## Load the credentials

```shell expandable lines wrap title="Shell" theme={null}
sudo systemctl daemon-reload
sudo systemctl restart strongswan-starter
sleep 8

sudo swanctl --load-creds --raw
```

<Check>
  The output includes `load-token reply {success=yes id=...}` along with `load-cert reply {success=yes}` for each certificate.
</Check>

If the reply is `success=no` with `loading private key from token failed`, charon reached the module but could not use the key. See [Troubleshooting](/Integrations/CryptoHub/VPN/strongSwan/Troubleshooting).

## Confirm with the charon log

```shell expandable lines wrap title="Shell" theme={null}
sudo grep -Ei 'load-token|found key|loaded RSA private key|pkcs11' /var/log/charon-debug.log | tail -20
```

<Check>
  The log shows the following sequence:

  ```
  loaded PKCS#11 v3.0 library 'futurex' (/usr/local/lib/fxpkcs11/libfxpkcs11.so)
    Futurex: FxPKCS11 v6.1
  plugin 'pkcs11': loaded successfully
  vici client 1 requests: load-token
  found key on PKCS#11 token 'futurex':0
  loaded RSA private key from token
  ```
</Check>

`loaded RSA private key from token` is the confirmation that charon can authenticate with a key that never leaves the CryptoHub.