> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Checklist of environment prerequisites and requirements before integrating SAP ASE with an Excrypt HSM.

Verify your environment meets these requirements.

## Supported hardware

* Excrypt HSM (formerly Vectera Plus), firmware `7.6.1.x` or later, with the **PKCS 11** feature enabled and major keys loaded.

## Supported operating systems

* SUSE Linux Enterprise Server 15 or openSUSE Leap 15 on x86-64

## Supported SAP ASE versions

* SAP Adaptive Server Enterprise 16.0 SP04 running the threaded kernel, with the `ASE_ENCRYPTION` option licensed.

> [!NOTE]
>
> SAP ASE supports an external keystore only in threaded kernel mode.

## Required software

* The latest 6.x version of the Futurex PKCS #11 (FXPKCS11) module for Linux x86-64, from the Futurex Portal.

> [!NOTE]
>
> SAP ASE loads the module into its own server process, which contains its own encryption provider. [Install Futurex PKCS #11 (FXPKCS11)](https://docs.futurex.com/Integrations/HSM/Database/SAP_ASE/Install_Futurex_PKCS_11_FXPKCS11.md) explains how to confirm that the module is compatible before you install it.

## Required access

* Both default administrator identities (**Admin1** and **Admin2**), or two identities with equivalent permissions. Creating application partitions and identities requires dual control, so both must log in.
* Root access on the SAP ASE host, to install the library and its configuration.
* The operating system account that runs SAP ASE (this guide uses `sybase`) and the `$SYBASE` installation directory (this guide uses `/opt/sap`).
* An SAP ASE login with `sso_role` and `keycustodian_role`, or with the `manage security configuration` and `manage master key` permissions when granular permissions are enabled.

## Network and firewall

* Allow outbound TCP port **9100** (default Excrypt port) from the SAP ASE host to the Excrypt HSM, specified by FQDN (for example, `hsm.example.com`) or CIDR (for example, `10.0.0.0/24`). The library carries every key operation over this port.
* If you configure the HSM over the network with FXCLI or Excrypt Manager, allow TCP port **9009** (default admin port) from that workstation to the HSM. Administrator logins work only on the admin port.

> [!WARNING]
>
> TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the Excrypt HSM FQDNs from inspection. Configure the HSM with an FQDN so the exemption applies.

## Plan for availability

SAP ASE decrypts each HSM-protected master key through the HSM before it uses it, including after every restart. If the HSM is unreachable or the stored credential is wrong, SAP ASE can't open the keys or the encrypted data until the HSM is reachable again. Before you encrypt production data, do the following:

* Keep a password-protected recovery copy of each master key, as described in the SAP ASE *Database Encryption* guide.
* Back up the HSM key according to your HSM backup procedure, so that the key survives a hardware failure.

## Other

* OpenSSL on the configuration workstation, to create the client TLS key and certificate signing request if you use mutual authentication.