> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Edit the Futurex CNG configuration file

> Instructions for modifying the fxcng.cfg file to configure Excrypt HSM connection parameters for the Futurex CNG library.

The Futurex **CNG** library uses the `fxcng.cfg` configuration file to connect to the HSM. It enables you to modify certain configurations and set connection details. This section covers the `<HSM>` portion of the **FXCNG** config file, where you set the connection details.

> [!NOTE]
>
> By default, the FXCNG library looks for the configuration file at `C:\Program Files\Futurex\fxcng\fxcng.cfg`. Alternatively, you can set the FXCNG\_CFG environment variable to the location of the `fxcng.cfg` file.

Open the `fxcng.cfg` file in a text editor as an administrator and edit it accordingly.

```none expandable lines wrap title="None" theme={null}
<HSM>
    # Which PKCS11 slot
    <SLOT>                  0                       </SLOT>
    <LABEL>                 Futurex                 </LABEL>

    # HSM crypto operator user name
    <CRYPTO-OPR>            [identity_name]         </CRYPTO-OPR>
    # Automatically login on session open
    <CRYPTO-OPR-PASS>       [identity_password]     </CRYPTO-OPR-PASS>

    # Connection information
    <ADDRESS>               [hsm_ip_address]        </ADDRESS>
    <PROD-PORT>             9100                    </PROD-PORT>
    <PROD-TLS-ENABLED>      YES                     </PROD-TLS-ENABLED>
    <PROD-TLS-ANONYMOUS>    NO                      </PROD-TLS-ANONYMOUS>
    # Windows Certificate Store
    <PROD-TLS-ENGINE>       WINDOWS                </PROD-TLS-ENGINE>
    <PROD-TLS-WIN-STORE>    My                     </PROD-TLS-WIN-STORE>
    <PROD-TLS-KEY>          Futurex CNG         </PROD-TLS-KEY>
    <PROD-TLS-CA>           /path/to/TlsCa.pem     </PROD-TLS-CA>

#    <PROD-TLS-CA>          /home/user/tls/root.pem  </PROD-TLS-CA>
#    <PROD-TLS-CA>          /home/user/tls/sub1.pem  </PROD-TLS-CA>
#    <PROD-TLS-CA>          /home/user/tls/sub2.pem  </PROD-TLS-CA>
#    <PROD-TLS-KEY>          C:\TLS\ClientPKI.p12    </PROD-TLS-KEY>
#    <PROD-TLS-KEY-PASS>     safest                  </PROD-TLS-KEY-PASS>

    # YES = This is communicating through a Guardian
    <FX-LOAD-BALANCE>       NO                      </FX-LOAD-BALANCE>
</HSM>
```

<table>
  <thead>
    <tr>
      <th>***Field***</th>
      <th>***Description***</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`<SLOT>`</td>
      <td>Leave it set to the default value of `0`.</td>
    </tr>

    <tr>
      <td>`<LABEL>`</td>
      <td>Leave it set to the default value of **Futurex**.</td>
    </tr>

    <tr>
      <td>`<CRYPTO-OPR>`</td>
      <td>Specify the name of the** identity** created for the application partition.</td>
    </tr>

    <tr>
      <td>`<CRYPTO-OPR-PASS>`</td>
      <td>Specify the password of the identity configured in the `<CRYPTO-OPR>` field. Use this to log the application into the HSM automatically if required.</td>
    </tr>

    <tr>
      <td>`<ADDRESS>`</td>
      <td>Specify the **IP address** of the HSM to which the **FXCNG** library should connect.</td>
    </tr>

    <tr>
      <td>`<PROD-PORT>`</td>
      <td>Set the port number of the HSM that the **FXCNG** library should connect to.</td>
    </tr>

    <tr>
      <td>`<PROD-TLS-ENABLED>`</td>
      <td>Set the field to **YES**. </td>
    </tr>

    <tr>
      <td>`<PROD-TLS-ANONYMOUS>`</td>
      <td>Defines whether the **FXCNG** library authenticates to the server. Set it to **NO** for mutual authentication (Option 2 in [Configure TLS authentication](https://docs.futurex.com/Integrations/HSM/Credential_management/Microsoft_OCSP_with_IIS/Configure_the_Vectera_Plus/Configure_TLS_authentication.md)), as in the sample above. Set it to **YES** for server-side authentication (Option 1), and leave out the `<PROD-TLS-ENGINE>`, `<PROD-TLS-WIN-STORE>`, `<PROD-TLS-KEY>`, and `<PROD-TLS-CA>` lines.</td>
    </tr>

    <tr>
      <td>`<PROD-TLS-ENGINE>`</td>
      <td>Setting the define to WINDOWS specifies that the TLS connection certificate is saved in the Windows Certificate Store rather than the local file system.</td>
    </tr>

    <tr>
      <td>`<PROD-TLS-WIN-STORE>`</td>
      <td>Specifying **My** in this field tells the **FXCNG** library to look for the TLS client certificate in the **Personal** Windows Certificate Store.</td>
    </tr>

    <tr>
      <td>`<PROD-TLS-KEY>`</td>
      <td>Specifies the **Common** **Name** of the TLS client certificate.</td>
    </tr>

    <tr>
      <td>`<PROD-TLS-CA>`</td>
      <td>You can use multiple instances of this define to specify where to save the CA certificate(s) in the file system. **FXCNG** does not pull CAs from the Windows Certificate Store.</td>
    </tr>

    <tr>
      <td>`<FX-LOAD-BALANCE>`</td>
      <td>Set this field to **YES** if you use a Guardian to manage HSM devices in a cluster. \
      If you don't use a Guardian, set it to **NO**</td>
    </tr>
  </tbody>
</table>

The provider reads `fxcng.cfg` each time a process loads it, so you don't need to run `CNGInstallUtil` again after a configuration change. Set the log file location next, then test the connection.

## Special define required for this integration

Add the following define to the `<CONFIG>` section of the **FXCNG** configuration file:

```none expandable lines wrap title="None" theme={null}
<LOGOUT-ON-SESSION-CLOSE> NO </LOGOUT-ON-SESSION-CLOSE>
```