Documentation Index
Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
Use this file to discover all available pages before exploring further.
For this step, you must log in with an identity that has a role with the Major Keys:Load permission. You can use the default Administrator role and Admin identities.
Commonly, HSMs within the same environment share major keys to enable synchronization and load balancing, though some settings might not require this.
Load the Futurex Token Key
The Futurex Token Key (FTK) wraps all keys stored on the HSM used with PKCS #11. If using multiple HSMs in a cluster, you can use the same FTK for syncing HSMs. An HSM must have an FTK before you can use it with PKCS #11. Choose one of the following methods to load the FTK:Excrypt Manager
Perform the following steps to use Excrypt Manager to load the FTK key:FXCLI
Perform the following steps to use FXCLI to load the FTK key:Run the following majorkey FXCLI command to load an FTK into the HSM. You must generate a random FTK if this is the first HSM you are setting up. Optionally, you can also load an FTK onto smart cards simultaneously with the
--fragments-required and --fragments-total flags, as shown in the following example:FXCLI
If you’re setting up a second HSM in a cluster, load the FTK from smart cards by running the remaining commands in this procedure.
This example recombines the fragments from only two smart cards. However, you can recombine fragments from up to nine smart cards.
Load the Platform Master Key
The Platform Master Key (PMK) is the primary major key used in general-purpose environments or those using AES cryptographic algorithms. It wraps all users and subordinate keys on the server. The PMK is typically a 256-bit AES key that encrypts system parameters, including SMTP passwords and SFTP credentials. The key is the default for creating or importing keys or certificates and is the major key for asymmetric key generation. Choose one of the following methods to load the PMK:Excrypt Manager
Perform the following steps to use Excrypt Manager to load the PMK:FXCLI
Perform the following steps to use Excrypt Manager to load the PMK:Run the following majorkey FXCLI commands to load a PMK into the HSM. You must generate a random PMK if this is the first HSM you are setting up. Optionally, you can also load a PMK onto smart cards simultaneously with the
--fragments-required and --fragments-total flags, as shown in the following example:FXCLI
If this is the second HSM you’re setting up in a cluster, load the PMK from smart cards by running the remaining commands in this procedure.
This example recombines fragments from only two smart cards, but you can recombine fragments from up to nine smart cards.
Load the Backup Encryption Key
The Vectera Plus also supports loading a Backup Encryption Key (BEK) to back up the HSM configuration or HSM keys. Choose one of the following methods to load the BEK:Excrypt Manager
Unlike other major keys on the HSM, if you load the BEK through Excrypt Manager, you must do so from the Maintenance menu. Perform the following steps to use Excrypt Manager to load the BEK:FXCLI
Perform the following steps to use FXCLI to load the BEK:Run the following majorkey FXCLI commands to load a BEK into the HSM. You must generate a random BEK if this is the first HSM you are setting up. Optionally, you can also load a PMK onto smart cards simultaneously with the
--fragments-required and --fragments-total flags, as shown in the following example:FXCLI
If this is the second HSM you’re setting up in a cluster, load the PMK from smart cards by running the remaining commands in this procedure.
This example recombines fragments from only two smart cards. However, you can recombine fragments from up to nine smart cards.