> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Futurex PKCS #11 (FXPKCS11)

> Check the Futurex PKCS #11 build for SAP ASE, install it in the SAP ASE library directory, and place its configuration file in /etc.

Install Futurex PKCS #11 (FXPKCS11) on the SAP ASE host. SAP ASE loads the library from `$SYBASE/ASE-16_0/lib`, and the library reads `/etc/fxpkcs11.cfg`.

This guide uses `/opt/sap` as `$SYBASE` and `sybase` as the account that runs SAP ASE. Replace them if your installation differs. Run the commands on this page as root, unless a step says otherwise.

## Extract the package

**Step 1**

Download the latest 6.x version of the Futurex PKCS #11 tarball for Linux from the Futurex Portal, copy it to the SAP ASE host, and then extract it to a staging directory:

```shell title="Shell" wrap theme={null}
mkdir -p /root/fxpkcs11-install
tar -xf fxpkcs11-<package>-<version>.tar -C /root/fxpkcs11-install
```

The `fxpkcs11` directory includes the following files and directories:

| File or directory | Description |
| - | - |
| `fxpkcs11.cfg` | PKCS #11 configuration file for HSM integrations. |
| `fxpkcs11-extended.cfg` | Annotated example configuration with every supported setting. |
| `fxpkcs11-kms.cfg` | Example configuration for KMES Series 3 integrations. You don't need it for HSM integrations. |
| `config-reference.md` | Reference for the configuration file settings. |
| `fxpkcs11.h` | Header file with the Futurex PKCS #11 extensions, for developers. |
| `LICENSE.txt` | License terms. |
| `x64/` | The 64-bit build: the library (`libfxpkcs11.so`), `configTest` (tests the configuration and connection to the HSM), `PKCS11Manager` (tests the connection and manages the HSM through the library), `info.txt` (version and build information), and `OpenSSL-LICENSE.txt`. |
| `x86/` | The 32-bit build. SAP ASE doesn't use it. |

The rest of this page uses `<build-dir>` for the directory that contains the 64-bit `libfxpkcs11.so`, for example `/root/fxpkcs11-install/fxpkcs11/x64`.

## Check the build

SAP ASE loads the library into its server process, which already contains functions with OpenSSL names. Before you install a build, confirm that it doesn't use or expose OpenSSL symbols.

**Step 1**

Go to the build directory:

```shell title="Shell" theme={null}
cd <build-dir>
```

**Step 2**

Confirm that the library doesn't depend on the system OpenSSL libraries:

```shell title="Shell" wrap theme={null}
ldd libfxpkcs11.so | grep -E 'libssl|libcrypto' || echo "OK: no dynamic OpenSSL dependency"
```

> [!TIP]
>
> The command prints `OK: no dynamic OpenSSL dependency`.

**Step 3**

Confirm that the library doesn't import or export OpenSSL symbols:

```shell title="Shell" wrap theme={null}
nm -D libfxpkcs11.so | grep -E ' (SSL|BIO|OPENSSL|CRYPTO)_' || echo "OK: no OpenSSL symbols"
```

> [!TIP]
>
> The command prints `OK: no OpenSSL symbols`.

**Step 4**

Confirm that the library binds its own symbols first:

```shell title="Shell" theme={null}
readelf -d libfxpkcs11.so | grep SYMBOLIC
```

> [!TIP]
>
> The output includes `SYMBOLIC`.

If any check fails, don't install the build, because SAP ASE stops with a segmentation fault when it loads it. Download the latest 6.x version of the Futurex PKCS #11 module and run the checks again.

## Install the library for SAP ASE

SAP ASE loads the PKCS #11 library that its HSM credential names from the `$SYBASE/ASE-16_0/lib` directory.

**Step 1**

Copy the library to the SAP ASE library directory and give the SAP ASE account ownership of it:

```shell title="Shell" wrap theme={null}
install -m 0755 -o sybase -g sybase <build-dir>/libfxpkcs11.so /opt/sap/ASE-16_0/lib/libfxpkcs11.so
```

> [!TIP]
>
> `ls -l /opt/sap/ASE-16_0/lib/libfxpkcs11.so` shows the library owned by `sybase` and executable.

**Step 2**

Copy the test programs to a directory that the SAP ASE account can use:

```shell title="Shell" wrap theme={null}
install -d -m 0750 -o sybase -g sybase /opt/sap/fxpkcs11-tools
install -m 0750 -o sybase -g sybase <build-dir>/configTest <build-dir>/PKCS11Manager /opt/sap/fxpkcs11-tools/
```

**Step 3**

Copy the configuration file to `/etc`, the default location where the library looks for it, and make it readable only by the SAP ASE account:

```shell title="Shell" wrap theme={null}
install -m 0600 -o sybase -g sybase /root/fxpkcs11-install/fxpkcs11/fxpkcs11.cfg /etc/fxpkcs11.cfg
```

> [!NOTE]
>
> To keep the configuration file somewhere else, set the `FXPKCS11_CFG` environment variable to its full path in the environment that starts SAP ASE, and for `configTest` and `PKCS11Manager`.

**Step 4**

Create a log directory that the SAP ASE account can write to:

```shell title="Shell" theme={null}
install -d -m 0750 -o sybase -g sybase /var/log/fxpkcs11
```

**Step 5**

Delete the staging directory:

```shell title="Shell" theme={null}
rm -rf /root/fxpkcs11-install
```

You configure `/etc/fxpkcs11.cfg` after you set up the HSM, in [Edit the Futurex PKCS #11 configuration file](https://docs.futurex.com/Integrations/HSM/Database/SAP_ASE/Edit_the_Futurex_PKCS_11_configuration_file.md).