> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install OpenBao with HSM support

> Install the official OpenBao HSM package (openbao-hsm 2.6.x), which includes the built-in PKCS #11 seal that the Futurex PKCS #11 library uses for auto-unseal.

The standard OpenBao package doesn't include PKCS #11 support. For this integration, install the `openbao-hsm` package, an official OpenBao build that includes the PKCS #11 seal.

> [!WARNING]
>
> Use OpenBao 2.6.x. OpenBao 2.7.0 removed the built-in PKCS #11 seal and discontinued the `openbao-hsm` packages. In OpenBao 2.7 and later, PKCS #11 seals require the external `kms-pkcs11` plugin, which doesn't work with the Futurex PKCS #11 library yet.

## Download the package

**Step 1**

Go to the [OpenBao releases page](https://github.com/openbao/openbao/releases) and open the latest 2.6.x release.

**Step 2**

Download the 64-bit (`amd64`) `openbao-hsm` package for your Linux distribution:

| Distribution | Package |
| - | - |
| Debian, Ubuntu | `openbao-hsm_<version>_linux_amd64.deb` |
| RHEL, Rocky Linux, Fedora | `openbao-hsm_<version>_linux_amd64.rpm` |
| Other | `openbao-hsm_<version>_linux_amd64.tar.gz` (binary only) |

**Step 3**

Verify the package checksum. Compare the output with the SHA-256 digest that the release page lists for the file:

```shell title="Shell" theme={null}
sha256sum openbao-hsm_<version>_linux_amd64.deb
```

## Install the package

**Debian, Ubuntu**

```shell title="Shell" theme={null}
sudo apt install ./openbao-hsm_<version>_linux_amd64.deb
```

**RHEL, Rocky Linux, Fedora**

```shell title="Shell" theme={null}
sudo dnf install ./openbao-hsm_<version>_linux_amd64.rpm
```

The package installs the following items:

| Item | Description |
| - | - |
| `/usr/bin/bao` | The OpenBao binary with PKCS #11 support. |
| `openbao` user and group | The system account that runs the OpenBao service. |
| `/usr/lib/systemd/system/openbao.service` | The systemd service. It reads environment variables from `/etc/openbao/openbao.env` and the configuration from `/etc/openbao/openbao.hcl`. |
| `/etc/openbao/openbao.hcl` | An example configuration. You replace it in [Configure OpenBao with the Futurex PKCS #11 library](https://docs.futurex.com/Integrations/HSM/Secrets_management/OpenBao/Configure_OpenBao_with_Futurex_PKCS_11_Library.md). |
| `/etc/openbao/openbao.env` | An empty environment file for the service. |
| `/opt/openbao/data`, `/opt/openbao/tls` | The data directory and a self-signed TLS key and certificate that the package generates during installation. |

> [!NOTE]
>
> The `openbao-hsm` package conflicts with the standard `openbao` package. If the standard package is installed, remove it first.

## Verify the installation

```shell title="Shell" theme={null}
bao version
```

> [!TIP]
>
> The version ends in `+hsm` and the output includes `(cgo)`, for example:
>
> ```text theme={null}
> OpenBao v2.6.3+hsm (63a65e6b907589dbb952c371a70260a065bf8bd7), committed 2026-09-23T16:41:56Z (cgo)
> ```

Don't start the service yet. Configure it first, as described in [Configure OpenBao with the Futurex PKCS #11 library](https://docs.futurex.com/Integrations/HSM/Secrets_management/OpenBao/Configure_OpenBao_with_Futurex_PKCS_11_Library.md).