Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

For this step, you need to log in with an identity that has a role with the following permissions:
  • Keys:All Slots
  • Management Commands:Certificates
  • Management Commands:Keys
  • Security:TLS Sign
  • TLS Settings:Upload Key
You can use the default Administrator role and Admin identities.
To configure TLS authentication, choose one of the following methods:
  1. Enable server-side authentication.
  2. Create connection certificates for mutual authentication.
We recommend option 2, mutual authentication.

​
Enable server-side authentication

We recommend mutually authenticating to the HSM using client certificates, but the Vectera Plus also supports server-side authentication. The following steps outline the process for enabling server-side authentication. Choose one of the following methods to enable server-side authentication:

​
Excrypt Manager

To enable server-side authentication, go to the SSL/TLS Setup menu. Then, select the Excrypt Port in the Connection Pair drop-down list, check the Allow Anonymous box, and select [ Save ].

​
FXCLI

Run the tls-ports set FXCLI command to enable server-side authentication with the Allow Anonymous SSL/TLS setting:
FXCLI
  tls-ports set -p "Excrypt Port" --anon

​
Create connection certificates, a client keypair, and a CSR

As mentioned previously, we recommend mutually authenticating to the HSM by using client certificates, and the system enforces mutual authentication by default. The following example shows how to use FXCLI to generate a CA to sign the HSM server certificate and a Futurex EKM (FXEKM) client certificate. Then, it shows how to generate the client key pair and CSR by using the Windows certreq utility.
  • For this example, you must connect the computer running FXCLI to the front USB port of the HSM.
  • If you do not specify a file path for commands that create an output file, FXCLI saves the file to the current working directory.
  • Using user-generated certificates requires you to load a PMK on the HSM.
  • If you run help by itself, a full list of available commands displays. You can see the options for a command by running the command name followed by help.

​
Create and sign the CSRs

This section explains the necessary steps to generate a CSR from a certreq policy file on the computer where you installed the Futurex EKM. When you generate the CSR file, the system creates a public/private key pair in the Windows Certificate Store. Then, the section describes how to use FXCLI to issue a signed certificate from the CSR, which you later associate with the public/private key pair stored in the Windows Certificate Store.

​
Create a certreq policy file

Perform the following steps to create a certreq policy file:
1
On the computer where Futurex EKM is installed, open a text editor.
2
Create a new file and copy and paste the following content into it:
None
[Version]
Signature = "$Windows NT$"

[NewRequest]
Subject = "CN=Futurex EKM"
Exportable = TRUE
KeyLength = 2048
MachineKeySet = TRUE
3
Save the file with the .inf extension (for example, certreq_policy.inf).

​
Generate a CSR

Perform the following steps to generate a CSR from the certreq policy INF file:
1
Open either Command Prompt or PowerShell.
2
Go to the directory with the certreq policy .inf file.
3
Run the following command to generate a CSR from the certreq policy .inf file:
Powershell
certreq -new -q -config "your.domain.com\Futurex EKM" certreq_policy.inf client.csr

​
Generate a key pair and CSR

Perform the following steps to generate a key pair and CSR for the Excrypt Port on the HSM:
1
Open the FXCLI prompt by running fxcli-hsm in a terminal.
2
Connect your laptop to the HSM through the USB port on the front and run the following command:
FXCLI
  connect usb
3
Use the following command to log in with the default Admin1 and Admin2 identities. When prompted, enter the username and password. Run the command twice, once for each identity.
FXCLI
  login user
4
Generate a key pair and CSR for the Excrypt Port by using the following command:
FXCLI
  tls-ports request --pair "Excrypt Port" --file excrypt_port.csr --pki-algo RSA

​
Generate a key pair and certificate

Perform the following steps to generate a TLS CA key pair and certificate with FXCLI:
1
Open the FXCLI prompt by running fxcli-hsm in a terminal.
2
Connect your laptop to the HSM through the USB port on the front and run the following command:
FXCLI
  connect usb
3
Use the following command to log in with the default Admin1 and Admin2 identities. When prompted, enter the username and password. Run the command twice, once for each identity.
FXCLI
  login user
4
Generate a TLS CA key pair and store it in an available slot on the HSM
FXCLI
  generate --algo RSA --bits 2048 --usage mak --name TlsCaKeyPair --slot next
5
Create a TLS CA certificate from the key pair you created in step 4.
FXCLI
  x509 sign \
      --private-slot TlsCaKeyPair \
      --key-usage DigitalSignature --key-usage KeyCertSign \
      --ca true --pathlen 0 \
      --dn 'O=Futurex\CN=Root' \
      --out TlsCa.pem

​
Sign the CSRs

Perform the following steps to sign the CSRs for the Excrypt Port and Futurex EKM:
1
Open the FXCLI prompt by running fxcli-hsm in a terminal.
2
Connect your laptop to the HSM through the USB port on the front and run the following command:
FXCLI
  connect usb
3
Use the following command to log in with the default Admin1 and Admin2 identities. When prompted, enter the username and password. Run the command twice, once for each identity.
FXCLI
  login user
4
Sign the CSR for the Excrypt Port using the CA you created in the previous section.
FXCLI
  x509 sign \
      --private-slot TlsCaKeyPair \
      --issuer TlsCa.pem \
      --csr excrypt_port.csr \
      --eku Server --key-usage DigitalSignature --key-usage KeyAgreement \
      --ca false \
      --dn 'O=Futurex\CN=Excrypt Port' \
      --out signed_excrypt_cert.pem
5
Push the signed server PKI to the Excrypt Port on the HSM.
FXCLI
  tls-ports set --pair "Excrypt Port" \
      --enable \
      --pki-source Generated \
      --clear-pki \
      --ca TlsCa.pem \
      --cert signed_excrypt_cert.pem \
      --no-anon
6
Restart the SSL2TCP processor to apply the changes made to the Excrypt Port connection pair.
FXCLI
  tls-ports restart
7
Sign the client CSR for Futurex EKM using the CA you created in the previous section.
FXCLI
  x509 sign  \
   --private-slot TlsCaKeyPair \
   --issuer TlsCa.pem \
   --csr client.csr \
   --eku Client --key-usage DigitalSignature --key-usage KeyAgreement \
   --out signed_client_cert.pem

​
Create an association

This section explains the necessary steps to associate the signed Futurex EKM client TLS certificate with its corresponding private key in the Windows Certificate Store. Before making this association, you must import the CA certificate that issued the EKM client TLS certificate into the Trusted Root Certification Authorities Windows Certificate Store.

​
Import the CA certificate

Perform the following steps to import the CA certificate that issued the Futurex EKM client TLS certificate into the Trusted Root Certification Authorities store:
1
On the computer where Futurex EKM is installed, open the Manage computer certificates program.
2
Right-click the Trusted Root Certification Authorities store and select All Tasks > Import.
3
Follow the steps in the Certificate Import Wizard to import the TLS CA root certificate file.
If it succeeds, you see a confirmation message.

​
Associate the certificate with the private key

Perform the following steps to associate the signed Futurex EKM certificate with its corresponding private key in the Windows Certificate Store:
1
Open either Command Prompt or PowerShell.
2
Go to the directory with the signed Futurex EKM client TLS certificate file.
3
Run the following command to create an association between the signed Futurex EKM certificate and its corresponding key pair stored in your Windows account profile:
Powershell
certreq -accept -machine signed_client_cert.pem
If the command succeeds, information about the installed certificate displays.