Skip to main content
Install the Futurex CNG (FXCNG) provider so Microsoft SignTool can sign files with a code-signing key that is stored in the Excrypt HSM.
Install the Futurex CNG provider on the computer where you run SignTool. Install FXCLI on the workstation you use to configure the HSM.
Install FXCNG from its own package, not from the FXTools installer. FXTools installs the Futurex CNG module and the Futurex FXCL KMES CNG provider by default, and the two providers conflict on the same computer. If FXTools is already installed on the signing computer, uninstall it before you continue.

​
Install the Futurex CNG provider

1
Download the Futurex CNG package (fxcng-<version>.zip) from the Futurex Portal. Use the latest FXCNG 6.x release.
2
Open PowerShell as an administrator and extract the package. Copy the 64-bit files to the default installation directory:
PowerShell
C:\Program Files\Futurex\fxcng contains fxcng.dll, fxcng.cfg, CNGInstallUtil.exe, InstallCNG.bat, and UninstallCNG.bat. The package’s info.txt lists the FXCNG version and revision.
3
Register the provider:
PowerShell
The output ends with the following lines:
CNGInstallUtil copies fxcng.dll to C:\Windows\System32, which is the copy Windows loads. To upgrade FXCNG later, copy the new files to C:\Program Files\Futurex\fxcng and run the same install command again.
Configure the provider in Edit the Futurex CNG configuration file before you verify it.

​
Install FXCLI

Install FXCLI on the workstation you use to configure the HSM. You need it to create the application partition and identity, and to set up TLS certificates for mutual authentication. Download the FXCLI package for your operating system from the Futurex Portal. On Linux, choose the package that matches the architecture (amd64 or i386) and the OpenSSL branch (openssl version: ssl1.0, ssl1.1, or ssl3), then install it:
Shell
For an rpm package, run sudo rpm -ivh [fxcl-xxxx.rpm] instead. Run fxcli-hsm to open the FXCLI prompt, and run help to list the available commands.
If you configure the HSM from a Windows workstation that gets FXCLI from FXTools, don’t use that workstation as the signing computer, or clear the Futurex CNG Module in the FXTools installer.

​
Verify the provider

After you edit the configuration file, confirm that Windows loads the provider and that it reaches the HSM:
PowerShell
The certutil -csplist output lists the provider without an error line under it:
certutil -key -csp "Futurex CNG" ends with CertUtil: -key command completed successfully. and lists the keys the identity can see. If certutil -csplist reports Futurex CNG: Provider DLL could not be found., Windows can’t load fxcng.dll; install the latest FXCNG package.
Use the provider name exactly as certutil -csplist shows it (Futurex CNG) in the certutil -repairstore command later in this guide.