Allow outbound TCP port 9100(default Excrypt port) from the computer running Futurex CNG to the Excrypt HSM, specified by FQDN (for example, hsm.example.com) or CIDR (for example, 10.0.0.0/24).
TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the Excrypt HSM FQDN(s) from inspection. Configure the Excrypt HSM with a FQDN so the exemption applies.