> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenSSL Provider

> Conceptual overview of using OpenSSL providers with Futurex HSMs via PKCS #11, including rationale and architecture.

This document provides information on configuring Futurex HSMs with OpenSSL providers by using PKCS #11 libraries. For additional questions related to your HSM, see the relevant administrator guide.

## Application description

From the main **Latchset - pkcs11-provider** on GitHub ([**https://github.com/latchset/pkcs11-provider)**](https://github.com/latchset/pkcs11-provider):

This is an OpenSSL 3.x provider to access Hardware and Software Tokens using the PKCS#11 Cryptographic Token Interface. Access to tokens depends on loading an appropriate PKCS#11 driver that knows how to talk to the specific token. The PKCS#11 provider is a connector that allows OpenSSL to make proper use of such drivers. This code targets PKCS#11 version 3.1 but is backwards compatible to version 3.0 and 2.40 as well.

## Why providers instead of engines

OpenSSL 3.x introduced a **provider-based architecture**, replacing the deprecated **engine system** from OpenSSL 1.x.

<table>
  <thead>
    <tr>
      <th>**Feature**</th>
      <th>**OpenSSL 1.x Engine**</th>
      <th>**OpenSSL 3.x Provider**</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Integration</td>
      <td>Manual load, low-level `ENGINE_*` APIs</td>
      <td>Modular, auto-loadable, integrated with EVP/config</td>
    </tr>

    <tr>
      <td>Hardware Access</td>
      <td>Requires engine-specific glue code</td>
      <td>Standardized PKCS#11–style provider modules</td>
    </tr>

    <tr>
      <td>FIPS Support</td>
      <td>Separate FIPS engine, complex integration</td>
      <td>Dedicated FIPS provider simplifies certification</td>
    </tr>

    <tr>
      <td>Flexibility</td>
      <td>Harder to extend, single-engine focus</td>
      <td>Easier to extend, multiple providers can coexist</td>
    </tr>
  </tbody>
</table>

In short: providers are **modern, modular, and fully supported,** making them the preferred method for PKCS#11 HSM integration.

## Why Latchset pkcs11-provider

* Direct integration with OpenSSL 3.x provider API
* Variety of successful integrations tested with Futurex HSMs
* Supports PKCS#11 3.0+ tokens without extra libraries
* Simplifies configuration compared to engines

## Guardian integration

The Guardian Series 3 introduces mission-critical viability to core cryptographic infrastructure, including:

* Centralization of device management
* Elimination of points of failure
* Distribution of transaction loads
* Group-specific function blocking
* User-defined grouping systems

See the applicable guide in the Futurex Portal for configuring HSMs with the Guardian Series 3, including PKCS #11 and CNG configuration.