Skip to main content
Install Futurex PKCS #11 (FXPKCS11) on the SAP ASE host. SAP ASE loads the library from $SYBASE/ASE-16_0/lib, and the library reads /etc/fxpkcs11.cfg. This guide uses /opt/sap as $SYBASE and sybase as the account that runs SAP ASE. Replace them if your installation differs. Run the commands on this page as root, unless a step says otherwise.

​
Extract the package

1
Download the latest 6.x version of the Futurex PKCS #11 tarball for Linux from the Futurex Portal, copy it to the SAP ASE host, and then extract it to a staging directory:
Shell
The fxpkcs11 directory includes the following files and directories:The rest of this page uses <build-dir> for the directory that contains the 64-bit libfxpkcs11.so, for example /root/fxpkcs11-install/fxpkcs11/x64.

​
Check the build

SAP ASE loads the library into its server process, which already contains functions with OpenSSL names. Before you install a build, confirm that it doesn’t use or expose OpenSSL symbols.
1
Go to the build directory:
Shell
2
Confirm that the library doesn’t depend on the system OpenSSL libraries:
Shell
The command prints OK: no dynamic OpenSSL dependency.
3
Confirm that the library doesn’t import or export OpenSSL symbols:
Shell
The command prints OK: no OpenSSL symbols.
4
Confirm that the library binds its own symbols first:
Shell
The output includes SYMBOLIC.
If any check fails, don’t install the build, because SAP ASE stops with a segmentation fault when it loads it. Download the latest 6.x version of the Futurex PKCS #11 module and run the checks again.

​
Install the library for SAP ASE

SAP ASE loads the PKCS #11 library that its HSM credential names from the $SYBASE/ASE-16_0/lib directory.
1
Copy the library to the SAP ASE library directory and give the SAP ASE account ownership of it:
Shell
ls -l /opt/sap/ASE-16_0/lib/libfxpkcs11.so shows the library owned by sybase and executable.
2
Copy the test programs to a directory that the SAP ASE account can use:
Shell
3
Copy the configuration file to /etc, the default location where the library looks for it, and make it readable only by the SAP ASE account:
Shell
To keep the configuration file somewhere else, set the FXPKCS11_CFG environment variable to its full path in the environment that starts SAP ASE, and for configTest and PKCS11Manager.
4
Create a log directory that the SAP ASE account can write to:
Shell
5
Delete the staging directory:
Shell
You configure /etc/fxpkcs11.cfg after you set up the HSM, in Edit the Futurex PKCS #11 configuration file.