> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Initial setup

> Step-by-step instructions for initial setup of Futurex HSMs for payment use cases using FXCLI or Excrypt Manager.

This section provides instructions for performing the minimum initial setup tasks required for all payment-related use cases on Futurex HSMs. You can make these configurations by using either **Excrypt** **Manager** or **Futurex Client Tools (FXCLI)**.

* FXCLI (required)
  * Available for all operating systems
  * You can use this tool to perform all initial setup tasks, but you must use it to configure TLS mutual authentication between the HSM and the payment application you are integrating.
* Excrypt Manager (optional)
  * Available only for Windows
  * This tool provides a GUI option for performing most initial configurations on the HSM.

## Install FXCLI

Choose one of the following operating systems and perform the instructions:

### Windows

Perform the following steps to install FXCLI on Windows:

<Steps>
  <Step>
    The FXTools installation package includes FXCLI. The easiest way to install FXCLI on Windows is by installing FXTools. You can download FXTools from the Futurex Portal.
  </Step>

  <Step>
    To install FXCLI, run the Futurex Tools installer as an administrator and follow the prompts in the setup wizard to complete the installation.
  </Step>

  <Step>
    By default, all tools are installed on the system. The user can overwrite and choose not to install certain modules. The modules include:

    <table>
      <thead>
        <tr>
          <th><em><strong>Module</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Futurex Client Tools</strong></td>
          <td>Command Line Interface (CLI) and associated SDK for both Java and C,</td>
        </tr>

        <tr>
          <td><strong>Futurex CNG Module</strong></td>
          <td>The Microsoft Next Generation Cryptographic Library.</td>
        </tr>

        <tr>
          <td><strong>Futurex Cryptographic Service Provider (CSP)</strong></td>
          <td>The Legacy Microsoft Cryptographic Libary.</td>
        </tr>

        <tr>
          <td><strong>Futurex EKM Module</strong></td>
          <td>The Microsoft Enterprise Key Management library.</td>
        </tr>

        <tr>
          <td><strong>Futurex PKCS #11 Module</strong></td>
          <td>The Futurex PKCS #11 library and associated tools.</td>
        </tr>

        <tr>
          <td><strong>Futurex Secure Access Client</strong></td>
          <td>The Client used to connect an Excrypt Touch to a local laptop through USB with a remote Futurex device.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    After starting the installation, all noted services are installed. If the Futurex Secure Access Client was selected, the Futurex Excrypt Touch driver is also installed. This application might start minimized or run in the background.
  </Step>
</Steps>

### Linux

Perform the following steps to install FXCLI on Linux:

<Steps>
  <Step>
    Download the appropriate FXCLI package files for your system from the Futurex Portal.
  </Step>

  <Step>
    If the system is 64-bit, select from the files marked amd64. If the system is 32-bit, select from the files marked i386.
  </Step>

  <Step>
    If running an OpenSSL version in the 1.0.x branch, select from the files marked ssl1.0. If running an OpenSSL version in the 1.1.x branch, select from the files marked ssl1.1.

    We offer the following features in FXCLI:

    * Java Software Development Kit (**java**)
    * HSM command line interface (**cli-hsm**)
    * KMES command line interface (**cli-kmes**)
    * Software Development Kit headers (**devel**)
    * YAML parser used to parse bash output (**cli-fxparse**)
  </Step>

  <Step>
    To install an **rpm** package, run the following command in a terminal:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo rpm -ivh [fxcl-xxxx.rpm]
    ```

    To install a **deb** package, run the following command in a terminal:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo dpkg -i [fxcl-xxxx.deb]
    ```
  </Step>

  <Step>
    To run FXCLI and enter the HSM FXCLI prompt, run the following command in a terminal:

    ```shell expandable lines wrap title="Shell" theme={null}
    fxcli-hsm
    ```
  </Step>

  <Step>
    After entering the FXCLI prompt, you can run **help** to list all of the available FXCLI commands.
  </Step>
</Steps>

To configure your HSM, you can use Excrypt Manager, a Windows application that provides a GUI-based method, or **FXCLI**, a command-line-based method that you can install on all platforms.

Keep the following considerations in mind:

* If you configure the Vectera Plus from a Linux computer, you can skip this section. If you configure it from a Windows computer, perform the FXCLI installation steps in the next section because FXCLI is the only method that you can use to configure TLS certificates in a later section.
* Install Excrypt Manager on the workstation on which you plan to configure the HSM.
* If you plan to use a Virtual HSM for the integration, you must perform all configurations by using either FXCLI, the Excrypt Touch, or the Guardian Series 3.
* The Excrypt Manager version must be from the 4.4.x branch or later to be compatible with the HSM firmware, which must be 7.2.x.x or later.

Perform the following steps to install Excrypt Manager in Windows:

<Steps>
  <Step>
    To install Excrypt Manager, run the Excrypt Manager installer as an administrator and follow the prompts in the setup wizard to complete the installation.
  </Step>

  <Step>
    The installation wizard prompts you to specify where you want to install Excrypt Manager. The default location is `C:\Program Files\Futurex\Excrypt Manager\`. After choosing a location, select **\[ Install ]**.
  </Step>
</Steps>

## Connect and Log In

For both **Excrypt** **Manager** and **FXCLI**, you must connect your laptop to the front USB port on the HSM. The initial login process described in this section uses the default Admin identities to log in under dual control.

<table>
  <thead>
    <tr>
      <th><em><strong>User #1 </strong></em></th>
      <th><em><strong>User #2</strong></em></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><strong>User ID</strong>: Admin1 </td>
      <td><strong>User ID</strong>: Admin2</td>
    </tr>

    <tr>
      <td>Password: safe </td>
      <td><strong>Password</strong>: safe</td>
    </tr>
  </tbody>
</table>

### Log in and connect

Select the appropriate method and follow the instructions:

<Tabs>
  <Tab title="Use Excrypt Manager">
    <Steps>
      <Step>
        Open Excrypt Manager and select **\[ Refresh ]** in the lower-right corner of the **Connection** menu. Then, select **USB Connection** and select **\[ Connect ]**.
      </Step>

      <Step>
        Log in with both default Admin identities.
      </Step>

      <Step>
        You must change the default Admin passwords for both of your default Admin identities (**Admin1** and **Admin2**) to load the major keys onto the HSM. To do so through Excrypt Manager, perform the following instructions:

        1. Open the **Identity** **Management** menu, select the first default Admin identity (**Admin1**), and select **\[ Change Password ]**.
        2. Enter the old password and enter the new password twice.
        3. Select **\[ OK ]**.
        4. Perform the same steps for the second default Admin identity (**Admin2**).
      </Step>
    </Steps>
  </Tab>

  <Tab title="Use FXCLI">
    <Steps>
      <Step>
        Start the FXCLI application and run the following commands:

        ```shell title="FXCLI" expandable lines wrap theme={null}
          connect usb
          login user
        ```

        <Note>
          The login command prompts for the username and password. You must run the command twice using both default Admin identities.
        </Note>
      </Step>

      <Step>
        You must change the default Admin passwords for both the default Admin Identities to load the major keys onto the HSM. Use the following FXCLI commands to change the passwords for each default Admin Identity:

        ```shell title="FXCLI" expandable lines wrap theme={null}
          user change-password -u Admin1
          user change-password -u Admin2
        ```

        <Note>
          The preceding user change-password commands prompt you to enter the old and new passwords.
        </Note>
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Configure the network

<Note>
  For this step, you must log in with an identity that has a role with permissions Communication:Network Settings. You can use the default Administrator role and Admin identities.
</Note>

Choose one of the following methods to configure the network:

## Excrypt Manager

To use Excrypt Manager to configure the network, go to the **Configuration** menu and modify the IP address configuration as needed.

## FXCLI

To use FXCLI to configure the network, run the **network interface modify** FXCLI command to set an IP address for the HSM. The following example shows the command syntax:

```shell title="FXCLI" expandable lines wrap theme={null}
  network interface modify --interface Ethernet1 --ip 10.221.0.10 --netmask 255.255.255.0 --gateway 10.221.0.1
```

<Note>
  At this point during the HSM configuration, consider the following:

  * Except for the final section, which covers creating connection certificates for mutual authentication, you can complete the remaining HSM configurations in this section by using the Guardian Series 3 (see the applicable guide for configuring HSMs for PKCS #11 integrations using the Guardian Series 3).
  * If you are performing the configuration on the HSM directly but plan to add it to a Guardian later, you might have to synchronize the HSM after you add it to a device group on the Guardian.
  * If your use case requires configuration through a CLI, then you should manage the HSMs directly.
</Note>

## Load major keys

The HSM requires you to load an **MFK (Master File Key)** before use. Depending on the intended use, you can also load a **PMK (Platform Master Key)**, **KEK (Key Encryption Key)**, and **FTK (Futurex Token Key)** at this point.

The HSM enables you to load some major keys through M of N fragmentation or a key wizard. With M of N key fragmentation, you can define the number of required key officers for a key ceremony that is less than the total number of key officers available. This helps maintain security while dramatically reducing the inconvenience of coordinating busy schedules around key ceremonies.

Choose the appropriate method and perform the instructions to load major keys:

<Tabs>
  <Tab title="Use Excrypt Manager">
    <Steps>
      <Step>
        Go to the **Key** **Management** menu and select **\[ Load ]** next to the relevant key.

        You can load keys through M of N fragmentation or a key wizard. If this is the first HSM in a cluster, we recommend that you generate the key and save it to smart cards as M of N fragments.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Use FXCLI">
    <Steps>
      <Step>
        If this is the first HSM you are setting up, you need to generate a random major key. Optionally, you can simultaneously load the generated key onto a smart card using the **-m** and **-n** flags.

        ```shell title="FXCLI" expandable lines wrap theme={null}
          majorkey random --mfk -m [number_from_2_to_9] -n [number_from_2_to_9]
        ```
      </Step>

      <Step>
        If you're setting up a second HSM that you're setting up in a cluster, then you load the major key from smart cards by using the following command:

        ```shell title="FXCLI" expandable lines wrap theme={null}
          majorkey recombine --key mfk
        ```
      </Step>
    </Steps>
  </Tab>
</Tabs>