> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Environment prerequisites and compatibility requirements to verify before you begin the OpenBao HSM integration.

Verify your environment meets these requirements.

## Supported hardware

* Excrypt HSM (formerly Vectera Plus), firmware `7.2.x.x` or later.

## Supported operating systems

* Linux with OpenSSL 1.0.x, 1.1.x, or 3.x. The Futurex PKCS #11 package includes a build for each OpenSSL branch; use the build that matches the OpenSSL version on the computer (`openssl version`).

## Required access

* Both default administrator identities (**Admin1** and **Admin2**), or two identities with equivalent permissions. Creating application partitions and identities requires dual control, so both must log in.
* Local administrator/root privileges on the computer where OpenBao is installed.

## Network and firewall

* Allow outbound TCP port **9100** (default Excrypt port) from the computer running OpenBao to the Excrypt HSM, specified by FQDN (for example, `hsm.example.com`) or CIDR (for example, `10.0.0.0/24`).
* If you configure the HSM over the network with FXCLI or Excrypt Manager, allow TCP port **9009** (default admin port) from that workstation to the HSM. Administrator logins work only on the admin port.

> [!WARNING]
>
> TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the Excrypt HSM FQDNs from inspection. Configure the HSM with an FQDN so the exemption applies.

## Supported software

* OpenBao 2.6.x, installed from the `openbao-hsm` package. OpenBao 2.6 is the last release line with a built-in PKCS #11 seal. For details, see [Install OpenBao with HSM support](https://docs.futurex.com/Integrations/HSM/Secrets_management/OpenBao/Install_patched_version_of_OpenBao.md).
* Futurex PKCS #11 (FXPKCS11) 6.5 or later.

## Other

* OpenSSL, to create the client TLS key and certificate signing request.
* OpenSC `pkcs11-tool`, to create the seal key on the HSM.