Install and configure Futurex PKCS #11

Install FXPKCS11 on the same computer as OpenVPN Access Server.

Perform the following steps to install Futurex PKCS #11:

Download the Futurex PKCS #11 tarball for Linux from the Futurex Portal.

Extract the tarball into /usr/local/lib, which creates the /usr/local/lib/fxpkcs11 directory:

Shell

sudo tar -xf fxpkcs11-linux-<version>.tar -C /usr/local/lib

For the Futurex PKCS #11 module to be accessible system-wide, an administrative user must extract it into /usr/local/lib. If only the current user needs to use the module, extract it into $HOME/.local/lib instead and adjust the paths in the following steps.

The fxpkcs11 directory contains the following files and directories:

File or directory	Description
`fxpkcs11.cfg`	PKCS #11 configuration file for HSM integrations.
`fxpkcs11-extended.cfg`	Annotated example configuration with every supported setting.
`fxpkcs11-kms.cfg`	Example configuration for KMES Series 3 integrations. You don’t need it for HSM integrations.
`config-reference.md`	Reference for every configuration setting and environment variable.
`x64/`	Builds for 64-bit systems, with one directory per OpenSSL branch (`OpenSSL-1.0.x`, `OpenSSL-1.1.x`, `OpenSSL-3.x`).
`x86/`	Builds for 32-bit systems, with directories for OpenSSL 1.0.x and 1.1.x only (`OpenSSL-1.0.x`, `OpenSSL-1.1.x`).

Each OpenSSL directory contains libfxpkcs11.so (the PKCS #11 library), configTest (tests the configuration and connection to the HSM), and PKCS11Manager (tests the connection and manages the HSM through the library).

Check which OpenSSL branch the computer uses:

Shell

openssl version

For example, OpenSSL 3.0.13 means you use the OpenSSL-3.x build. Ubuntu 22.04 and later and RHEL 9 and later use OpenSSL 3.x.

Copy the matching build into /usr/local/lib/fxpkcs11 so that the library path is /usr/local/lib/fxpkcs11/libfxpkcs11.so. The following example copies the 64-bit OpenSSL 3.x build:

Shell

sudo cp /usr/local/lib/fxpkcs11/x64/OpenSSL-3.x/{libfxpkcs11.so,configTest,PKCS11Manager} /usr/local/lib/fxpkcs11/

Copy the configuration file to /etc, the default location where the library looks for it:

Shell

sudo cp /usr/local/lib/fxpkcs11/fxpkcs11.cfg /etc/fxpkcs11.cfg

To keep the configuration file somewhere else, set the FXPKCS11_CFG environment variable to its full path for every process that loads the library, including configTest and PKCS11Manager.