Install Futurex PKCS #11 (FXPKCS11) - Futurex Documentation

Install FXPKCS11 on the same computer as the application that uses the OpenSSL pkcs11-provider.

Perform the following steps to install Futurex PKCS #11:

Download the Futurex PKCS #11 tarball for Linux from the Futurex Portal.

Extract the tarball into /usr/local/lib, which creates the /usr/local/lib/fxpkcs11 directory:

Shell

sudo tar -xf fxpkcs11-linux-<version>.tar -C /usr/local/lib

For the Futurex PKCS #11 module to be accessible system-wide, an administrative user must extract it into /usr/local/lib. If only the current user needs to use the module, extract it into $HOME/.local/lib instead and adjust the paths in the following steps.

The fxpkcs11 directory contains the following files and directories:

File or directory	Description
`fxpkcs11.cfg`	PKCS #11 configuration file for HSM integrations.
`fxpkcs11-extended.cfg`	Annotated example configuration with every supported setting.
`fxpkcs11-kms.cfg`	Example configuration for KMES Series 3 integrations. You don’t need it for HSM integrations.
`config-reference.md`	Reference for every configuration setting and environment variable.
`x64/`	Builds for 64-bit systems, with one directory per OpenSSL branch (`OpenSSL-1.0.x`, `OpenSSL-1.1.x`, `OpenSSL-3.x`).
`x86/`	Builds for 32-bit systems, with directories for OpenSSL 1.0.x and 1.1.x only (`OpenSSL-1.0.x`, `OpenSSL-1.1.x`).

Each OpenSSL directory contains libfxpkcs11.so (the PKCS #11 library), configTest (tests the configuration and connection to the HSM), and PKCS11Manager (tests the connection and manages the HSM through the library).

Check which OpenSSL branch the computer uses:

Shell

openssl version

For example, OpenSSL 3.0.13 means you use the OpenSSL-3.x build. Ubuntu 22.04 and later and RHEL 9 and later use OpenSSL 3.x.

Copy the matching build into /usr/local/lib/fxpkcs11 so that the library path is /usr/local/lib/fxpkcs11/libfxpkcs11.so. The following example copies the 64-bit OpenSSL 3.x build:

Shell

sudo cp /usr/local/lib/fxpkcs11/x64/OpenSSL-3.x/{libfxpkcs11.so,configTest,PKCS11Manager} /usr/local/lib/fxpkcs11/

Copy the configuration file to /etc, the default location where the library looks for it:

Shell

sudo cp /usr/local/lib/fxpkcs11/fxpkcs11.cfg /etc/fxpkcs11.cfg

To keep the configuration file somewhere else, set the FXPKCS11_CFG environment variable to its full path for every process that loads the library, including configTest and PKCS11Manager.

Java and OpenSSL

If you plan to install Java and OpenSSL on the same system, see Using OpenSSL and Java.

​Java and OpenSSL

Java and OpenSSL