Install Futurex PKCS #11 (FXPKCS11) - Futurex Documentation

Install FXPKCS11 on the same computer as the application for the integration.

Select your operating system and perform the following steps to install Futurex PKCS #11:

Windows

Perform the following steps to install Futurex PKCS #11 in Windows:

In a Windows environment, the easiest way to install the Futurex PKCS #11 module is to download FXTools from the Futurex Portal and install it.

After you download FXTools, run the installer as an administrator.

By default, the system installs all tools. You can overwrite and choose not to install the following modules:

Module	Description
Futurex Client Tools	Command Line Interface (CLI) and associated SDK for both Java and C.
Futurex CNG Module	The Microsoft Next Generation Cryptographic Library.
Futurex Cryptographic Service Provider (CSP)	The Legacy Microsoft Cryptographic Library.
Futurex EKM Module	The Microsoft Enterprise Key Management library.
Futurex PKCS #11 Module	The Futurex PKCS #11 library and associated tools.
Futurex Secure Access Client	The Client that connects a Futurex Excrypt Touch to a local laptop with a USB or to a remote Futurex device.

After starting the installation, the system installs all noted services. If you selected the Futurex Secure Access Client, the Excrypt Touch driver is also installed and might start minimized or in the background.

The installation installs all services in the C:\Program Files\Futurex directory. The CNG Module, CSP Module, EKM Module, and PKCS #11 Module all require configuration files, located in their corresponding directory with a .cfg extension.

Linux

Perform the following steps to install Futurex PKCS #11 in Linux:

Download the Futurex PKCS #11 tarball for Linux from the Futurex Portal.

Extract the tarball into /usr/local/lib, which creates the /usr/local/lib/fxpkcs11 directory:

Shell

sudo tar -xf fxpkcs11-linux-<version>.tar -C /usr/local/lib

For the Futurex PKCS #11 module to be accessible system-wide, an administrative user must extract it into /usr/local/lib. If only the current user needs to use the module, extract it into $HOME/.local/lib instead and adjust the paths in the following steps.

The fxpkcs11 directory contains the following files and directories:

File or directory	Description
`fxpkcs11.cfg`	PKCS #11 configuration file for HSM integrations.
`fxpkcs11-extended.cfg`	Annotated example configuration with every supported setting.
`fxpkcs11-kms.cfg`	Example configuration for KMES Series 3 integrations. You don’t need it for HSM integrations.
`config-reference.md`	Reference for every configuration setting and environment variable.
`x64/`	Builds for 64-bit systems, with one directory per OpenSSL branch (`OpenSSL-1.0.x`, `OpenSSL-1.1.x`, `OpenSSL-3.x`).
`x86/`	Builds for 32-bit systems, with directories for OpenSSL 1.0.x and 1.1.x only (`OpenSSL-1.0.x`, `OpenSSL-1.1.x`).

Each OpenSSL directory contains libfxpkcs11.so (the PKCS #11 library), configTest (tests the configuration and connection to the HSM), and PKCS11Manager (tests the connection and manages the HSM through the library).

Check which OpenSSL branch the computer uses:

Shell

openssl version

For example, OpenSSL 3.0.13 means you use the OpenSSL-3.x build. Ubuntu 22.04 and later and RHEL 9 and later use OpenSSL 3.x.

Copy the matching build into /usr/local/lib/fxpkcs11 so that the library path is /usr/local/lib/fxpkcs11/libfxpkcs11.so. The following example copies the 64-bit OpenSSL 3.x build:

Shell

sudo cp /usr/local/lib/fxpkcs11/x64/OpenSSL-3.x/{libfxpkcs11.so,configTest,PKCS11Manager} /usr/local/lib/fxpkcs11/

Copy the configuration file to /etc, the default location where the library looks for it:

Shell

sudo cp /usr/local/lib/fxpkcs11/fxpkcs11.cfg /etc/fxpkcs11.cfg

To keep the configuration file somewhere else, set the FXPKCS11_CFG environment variable to its full path for every process that loads the library, including configTest and PKCS11Manager.

​Windows

​Linux

Windows

Linux