> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Edit the Futurex CNG configuration file

> Guide to editing the fxcng.cfg file to configure HSM connection parameters for the Futurex CNG library.

The Futurex CNG library uses the Futurex **CNG** configuration file, `fxcng.cfg`, to connect to the HSM. It enables you to modify certain configurations and set connection details. This section covers the `<HSM>` portion of the **FXCNG** configuration file where you configure the connection details.

<Note>
  By default, the FXCNG library looks for the configuration file at `C:\Program Files\Futurex\fxcng\fxcng.cfg`. Alternatively, you can set the FXCNG\_CFG environment variable to the location of the `fxcng.cfg` file.
</Note>

Open the `fxcng.cfg` file in a text editor as an administrator and edit it accordingly.

```none expandable lines wrap title="None" theme={null}
<HSM>
    # Which PKCS11 slot
    <SLOT>                  0                       </SLOT>
    <LABEL>                 Futurex                 </LABEL>

    # HSM crypto operator user name
    <CRYPTO-OPR>            [identity_name]         </CRYPTO-OPR>
    # Automatically login on session open
    <CRYPTO-OPR-PASS>       [identity_password]     </CRYPTO-OPR-PASS>

    # Connection information
    <ADDRESS>               [hsm_ip_address]        </ADDRESS>
    <PROD-PORT>             9100                    </PROD-PORT>
    <PROD-TLS-ENABLED>      YES                     </PROD-TLS-ENABLED>
    <PROD-TLS-ANONYMOUS>    NO                      </PROD-TLS-ANONYMOUS>
    # Windows Certificate Store
    <PROD-TLS-ENGINE>       WINDOWS                </PROD-TLS-ENGINE>
    <PROD-TLS-WIN-STORE>    My                     </PROD-TLS-WIN-STORE>
    <PROD-TLS-KEY>          Futurex CNG         </PROD-TLS-KEY>
    <PROD-TLS-CA>           /path/to/TlsCa.pem     </PROD-TLS-CA>

#    <PROD-TLS-CA>          /home/user/tls/root.pem  </PROD-TLS-CA>
#    <PROD-TLS-CA>          /home/user/tls/sub1.pem  </PROD-TLS-CA>
#    <PROD-TLS-CA>          /home/user/tls/sub2.pem  </PROD-TLS-CA>
#    <PROD-TLS-KEY>          C:\TLS\ClientPKI.p12    </PROD-TLS-KEY>
#    <PROD-TLS-KEY-PASS>     safest                  </PROD-TLS-KEY-PASS>

    # YES = This is communicating through a Guardian
    <FX-LOAD-BALANCE>       NO                      </FX-LOAD-BALANCE>
</HSM>
```

<table>
  <thead>
    <tr>
      <th><em><strong>Field</strong></em></th>
      <th><em><strong>Description</strong></em></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>\<SLOT></code></td>
      <td>Leave set to the default value of <code>0</code>.</td>
    </tr>

    <tr>
      <td><code>\<LABEL></code></td>
      <td>Leave set to the default value of <strong>Futurex</strong>.</td>
    </tr>

    <tr>
      <td><code>\<CRYPTO-OPR></code></td>
      <td>Specify the name of the<strong> identity</strong> created for the application partition.</td>
    </tr>

    <tr>
      <td><code>\<CRYPTO-OPR-PASS></code></td>
      <td>Specify the password of the identity configured in the <code>\<CRYPTO-OPR></code> field. You can use this to log the application into the HSM automatically if necessary.</td>
    </tr>

    <tr>
      <td><code>\<ADDRESS></code></td>
      <td>Specify the <strong>IP address</strong> of the HSM to which the <strong>FXCNG</strong> library should connect.</td>
    </tr>

    <tr>
      <td><code>\<PROD-PORT></code></td>
      <td>Set the port number of the HSM that the <strong>FXCNG</strong> library should connect to.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-ENABLED></code></td>
      <td>Set the field to <strong>YES</strong>. </td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-ANONYMOUS></code></td>
      <td>Defines whether the <strong>FXPKCS11</strong> library authenticates to the server.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-ENGINE></code></td>
      <td>Setting the define to <strong>WINDOWS</strong> specifies the TLS connection certificate is saved in the Windows Certificate Store rather than on the local file system.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-WIN-STORE></code></td>
      <td>Specifying <strong>My</strong> in this field tells the <strong>FXCNG</strong> library to look for the TLS client certificate in the <strong>Personal</strong> Windows Certificate Store.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-KEY></code></td>
      <td>Specifies the <strong>Common</strong> <strong>Name</strong> of the TLS client certificate.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-CA></code></td>
      <td>You can use multiple instances of this define to specify where to save the CA certificates in the file system. <strong>FXCNG</strong> does not pull CAs from the Windows Certificate Store.</td>
    </tr>

    <tr>
      <td><code>\<FX-LOAD-BALANCE></code></td>
      <td>If you use a Guardian to manage HSM devices in a cluster, set this field to <strong>YES</strong>. <br />If you don't use a Guardian, set it to <strong>NO</strong>.</td>
    </tr>
  </tbody>
</table>

After you finish editing the `fxcng.cfg` file, run the `CNGInstallUtil` file to test the connection against the HSM, and check the `FxCNG-Install-Log.txt` file for errors and information.