Skip to main content
The standard OpenBao package doesn’t include PKCS #11 support. For this integration, install the openbao-hsm package, an official OpenBao build that includes the PKCS #11 seal.
Use OpenBao 2.6.x. OpenBao 2.7.0 removed the built-in PKCS #11 seal and discontinued the openbao-hsm packages. In OpenBao 2.7 and later, PKCS #11 seals require the external kms-pkcs11 plugin, which doesn’t work with the Futurex PKCS #11 library yet.

​
Download the package

1
Go to the OpenBao releases page and open the latest 2.6.x release.
2
Download the 64-bit (amd64) openbao-hsm package for your Linux distribution:
3
Verify the package checksum. Compare the output with the SHA-256 digest that the release page lists for the file:
Shell

​
Install the package

Shell
The package installs the following items:
The openbao-hsm package conflicts with the standard openbao package. If the standard package is installed, remove it first.

​
Verify the installation

Shell
The version ends in +hsm and the output includes (cgo), for example:
Don’t start the service yet. Configure it first, as described in Configure OpenBao with the Futurex PKCS #11 library.