> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure KMES Series 3

> Step-by-step guide to configure KMES Series 3 for Futurex PKCS #11 integration, including TLS setup.

This section starts with the general KMES configurations necessary to enable the Futurex PKCS #11 module to integrate with the KMES Series 3. Then, it covers the necessary steps to configure TLS communication between the KMES and the Futurex PKCS #11 Library.

## Configure general KMES settings

Perform the following tasks to configure the KMES Series 3 for communication with FXPKCS #11:

1. Create an FXPKCS #11 role and identity with the correct assigned permissions.
2. Enable Host API commands.

The following sections show you how to complete these tasks.

### Create a role and identity for FXPKCS #11

Perform the following steps to create a new role and identity with the required permissions for Futurex PKCS #11 (**FXPKCS11**) on the KMES Series 3. A later section shows you how to configure the identity name and password in the Futurex PKCS #11 configuration file.

<Steps>
  <Step>
    Log in to the KMES Series 3 application interface with the default Admin identities.
  </Step>

  <Step>
    Go to **Identity** **Management** > **Roles** and select **\[ Add ]** at the bottom of the page.
  </Step>

  <Step>
    In the **Info** tab of the **Role** **Editor** window, specify a **name** for the role and set the number of **logins** **required** to `1`**.**
  </Step>

  <Step>
    On the **Permissions** tab, select the following permissions:

    <table>
      <thead>
        <tr>
          <th><em><strong>Permission</strong></em></th>
          <th><em><strong>Subpermission</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Cryptographic</strong> <strong>Operations</strong></td>
          <td>Sign, Verify, Encrypt, Decrypt, Wrap, Unwrap, Derive</td>
        </tr>

        <tr>
          <td><strong>Keys</strong></td>
          <td>Add, Export</td>
        </tr>

        <tr>
          <td><strong>Certificate</strong> <strong>Authority</strong> </td>
          <td>Add, Export, Upload</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    On the **Advanced** tab, allow authentication to the **Host API** port only.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the role.
  </Step>

  <Step>
    Go to **Identity Management** > **Identities**.
  </Step>

  <Step>
    Right-click anywhere in the window and select **Add** > **Client Application**.
  </Step>

  <Step>
    On the **Info** tab of the **Identity Editor** window, select **Application** for the storage location and specify a name for the identity.
  </Step>

  <Step>
    On the **Assigned Roles** tab, select the Nginx role you just created.
  </Step>

  <Step>
    On the **Authentication** tab, select **Password** and then select **\[ Configure ]**.
  </Step>

  <Step>
    In the **Configure** **Credential** window, select **\[ Change ]**. Enter a password and select \[ **Save ]**.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the identity.
  </Step>
</Steps>

### Enable the Host API commands

Because the Futurex PKCS #11 library connects to the Host API port on the KMES, you must define which Host API commands to enable for execution by the **FXPKCS11** library. To set the required commands for FXPKCS #11 operation, complete the following steps:

<Steps>
  <Step>
    Log in to the KMES Series 3 application interface with the default Admin identities.
  </Step>

  <Step>
    Go to **Administration** > **Configuration** > **Host API Options** and enable the following commands:

    <table>
      <thead>
        <tr>
          <th><em><strong>Command</strong></em></th>
          <th><em><strong>Description or subcommand (if applicable)</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>ECHO</strong></td>
          <td>Communication Test or Retrieve Version</td>
        </tr>

        <tr>
          <td><strong>TIME</strong></td>
          <td>Set time</td>
        </tr>

        <tr>
          <td><strong>RAFA</strong></td>
          <td>Filter Issuance Policy</td>
        </tr>

        <tr>
          <td><strong>RAND</strong></td>
          <td>Generate a Random Number</td>
        </tr>

        <tr>
          <td><strong>RKCK</strong></td>
          <td>Create HSM Trusted Key</td>
        </tr>

        <tr>
          <td><strong>RKCP</strong></td>
          <td>Get Command Permissions</td>
        </tr>

        <tr>
          <td><strong>RKCS</strong></td>
          <td>Create Symmetric HSM Trusted Key Group</td>
        </tr>

        <tr>
          <td><strong>RKED</strong></td>
          <td>Encrypt or Decrypt Data</td>
        </tr>

        <tr>
          <td><strong>RKGP</strong></td>
          <td>Export Asymmetric HSM Trusted Key</td>
        </tr>

        <tr>
          <td><strong>RKGS</strong></td>
          <td>Generate Signature</td>
        </tr>

        <tr>
          <td><strong>RKHM</strong></td>
          <td>HMAC Data</td>
        </tr>

        <tr>
          <td><strong>RKLN</strong></td>
          <td>Lookup Objects</td>
        </tr>

        <tr>
          <td><strong>RKLO</strong></td>
          <td>Login User</td>
        </tr>

        <tr>
          <td><strong>RKRC</strong></td>
          <td>Get HSM Trusted Key</td>
        </tr>

        <tr>
          <td><strong>ATTR</strong></td>
          <td>Generic Attribute Operations <ul><li><strong>Get</strong>: Retrieve generic attributes</li></ul></td>
        </tr>

        <tr>
          <td><strong>ATKG</strong></td>
          <td>Add HSM trusted asymmetric key group</td>
        </tr>

        <tr>
          <td><strong>RKPK</strong></td>
          <td>Pop Generated Key</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    Select **\[ Save ]** to finish.
  </Step>
</Steps>

## Configure TLS communication

Perform the following tasks to configure TLS communication between the KMES Series 3 and the Futurex PKCS #11 module:

1. Create a Certificate Authority.
2. Generate a CSR for the System/Host API connection pair.
3. Sign the System/Host API CSR.
4. Export the Root CA.
5. Export the signed System/Host API TLS certificate.
6. Load the exported certificates into the System/Host API connection pair.
7. Issue a client certificate for the Futurex PKCS #11 module.
8. Export the client certificate as a PKCS #12 file.

The following sections describe how to perform these tasks.

### Create a CA

Perform the following steps to create a Certificate Authority (CA):

<Steps>
  <Step>
    Log in to the KMES Series 3 application interface with the default Admin identities.
  </Step>

  <Step>
    Go to **PKI** > **Certificate** **Authorities** and select **\[ Add CA ]** at the bottom of the page.
  </Step>

  <Step>
    In the **Certificate** **Authority** window, enter a name for the certificate container, leave all other fields set to the default values, and select **\[ OK ]**.

    <Check>
      The certificate container you just created now displays in the Certificate Authorities menu.
    </Check>
  </Step>

  <Step>
    Right-click the certificate container you just created and select **Add** **Certificate** > **New** **Certificate**.
  </Step>

  <Step>
    On the **Subject** **DN** tab, set a **Common Name** for the certificate, such as `System TLS CA Root`.
  </Step>

  <Step>
    On the **Basic** **Info** tab, leave all fields set to the default values.
  </Step>

  <Step>
    On the **V3** **Extensions** tab, select the **Certificate Authority** profile and select **\[ OK ]**.

    <Check>
      The root CA certificate now displays under the previously created certificate container.
    </Check>
  </Step>
</Steps>

### Generate a CSR

Perform the following steps to generate a CSR for the System/Host API connection pair:

<Steps>
  <Step>
    Go to **Administration** > **Configuration** > **Network** **Options**.
  </Step>

  <Step>
    In the **Network** **Options** window, go to the **TLS/SSL Settings** tab.
  </Step>

  <Step>
    Under the **System/Host API** connection pair, uncheck the **Use Futurex certificates** checkbox and select **\[ Edit ]** next to **PKI** **keys** in the **User** **Certificates** section.
  </Step>

  <Step>
    In the **Application Public Keys** window, select **\[ Generate ]**.
  </Step>

  <Step>
    When warned that *SSL will not be functional until new certificates are imported*, select **\[ Yes ]** to continue.
  </Step>

  <Step>
    In the **PKI Parameters** window, leave all fields set to the default values and select **\[ OK ]**.

    <Check>
      You should see that a PKI Key Pair is loaded now in the Application Public Keys window.
    </Check>
  </Step>

  <Step>
    Select **\[ Request ]**.
  </Step>

  <Step>
    On the **Subject DN** tab, set a **Common Name** for the certificate, such as `KMES`.
  </Step>

  <Step>
    On the **V3 Extensions** tab, select the **TLS Server Certificate** profile.
  </Step>

  <Step>
    On the **PKCS #10 Info** tab, select a save location for the CSR and select **\[ OK ]**.
  </Step>

  <Step>
    When prompted that *the certificate signing request was successfully written to the file location that was selected*, select **\[ OK ]**.
  </Step>

  <Step>
    Select **\[ OK ]** again to save the **Application Public Keys** settings.

    <Check>
      The main Network Options window now shows Loaded next to PKI keys for the System/Host API connection pair.
    </Check>
  </Step>
</Steps>

#### Sign the CSR

Perform the following steps to sign the System/Host API CSR:

<Steps>
  <Step>
    Go to **PKI** > **Certificate** **Authorities**.
  </Step>

  <Step>
    Right-click the root CA certificate you created and select **Add** **Certificate** > **From** **Request**.
  </Step>

  <Step>
    In the file browser, select the CSR that you generated for the System/Host API connection pair.
  </Step>

  <Step>
    After it loads, don't modify any settings for the certificate. Select **\[ OK ]**.

    <Check>
      The signed System/Host API certificate now shows under the root CA certificate on the Certificate Authorities page.
    </Check>
  </Step>
</Steps>

### Export the certificate

Perform the following steps to export the Root CA certificate:

<Steps>
  <Step>
    Go to **PKI** > **Certificate** **Authorities**.
  </Step>

  <Step>
    Right-click the System TLS CA Root certificate and select **Export** > **Certificate(s)**.
  </Step>

  <Step>
    In the **Export** **Certificate** window, change the encoding to **PEM** and select **\[ Browse ]**.
  </Step>

  <Step>
    In the file browser, go to the location where you want to save the Root CA certificate. Specify the name of the file and select **\[ Open ]**.
  </Step>

  <Step>
    Select **\[ OK ]**.

    <Check>
      A message box confirms that the PEM file was successfully written to the location that you specified.
    </Check>
  </Step>
</Steps>

### Export the certificate

Perform the following steps to export the signed System/Host API certificate:

<Steps>
  <Step>
    Go to **PKI** > **Certificate** **Authorities**.
  </Step>

  <Step>
    Right-click the KMES System/Host API certificate and select **Export** > **Certificate(s)**.
  </Step>

  <Step>
    In the **Export** **Certificate** window, change the encoding to **PEM** and select **\[ Browse ]**.
  </Step>

  <Step>
    In the file browser, go to the location where you want to save the Root CA certificate. Specify the name of the file and select **\[ Open ]**.
  </Step>

  <Step>
    Select **\[ OK ]**.

    <Check>
      A message box confirms that the PEM file was successfully written to the location that you specified.
    </Check>
  </Step>
</Steps>

### Load the certificates

Perform the following steps to load the exported certificates into the System/Host API connection pair:

<Steps>
  <Step>
    Go to **Administration** > **Configuration** > **Network** **Options**.
  </Step>

  <Step>
    In the **Network** **Options** window, go to the **TLS/SSL Settings** tab.
  </Step>

  <Step>
    Under the **System/Host API** connection pair, select **\[ Edit ]** next to **Certificates** in the **User** **Certificates** section.
  </Step>

  <Step>
    Right-click the **System/Host API SSL CA** X.509 certificate container and select **\[ Import ]**.
  </Step>

  <Step>
    Select **\[ Add ]** at the bottom of the **Import Certificates** window.
  </Step>

  <Step>
    In the file browser, select both the root CA certificate and the signed System/Host API certificate, and select **\[ Open ]**.
  </Step>

  <Step>
    Select **\[ OK ]** to save the changes.

    <Check>
      In the Network Options window, the System/Host API connection pair now displays Signed loaded next to Certificates in the User Certificates section.
    </Check>
  </Step>
</Steps>

### Issue a client certificate

Perform the following steps to issue a client certificate for the Futurex PKCS #11 module:

<Steps>
  <Step>
    Go to **PKI** > **Certificate** **Authorities**.
  </Step>

  <Step>
    Right-click the System TLS CA Root certificate and select **Add** **Certificate** > **New** **Certificate**.
  </Step>

  <Step>
    On the **Subject DN** tab, set a **Common Name** for the certificate.
  </Step>

  <Step>
    Leave all fields in the **Basic Info** tab set to the default values.
  </Step>

  <Step>
    On the **V3 Extensions** tab, select the **TLS Client Certificate** profile and select **\[ OK ]**.

    <Check>
      The PKCS #11 client certificate now displays under the System TLS CA Root certificate.
    </Check>
  </Step>
</Steps>

#### Export the client certificate

Perform the following steps to export the client certificate as a PKCS #12 file:

<Note>
  To perform the following steps, you must go to Configuration > Options and enable the Allow export of certificates using passwords option.
</Note>

<Steps>
  <Step>
    Go to **PKI** > **Certificate** **Authorities**.
  </Step>

  <Step>
    Right-click the PKCS #11 client certificate and select **Export** > **PKCS12**.
  </Step>

  <Step>
    Set a PKCS12 password, leave **Export Selected Certificate with Parents** selected, and select **\[ Next ]**.
  </Step>

  <Step>
    Enter a name for the file, select the location where you want to save it, and select **\[ Open ]** to start the export.
  </Step>

  <Step>
    Move the **FXPKCS11** Client certificate to the computer where you installed the Futurex PKCS #11 module.

    A later section shows you how to configure it in the **FXPKCS11** configuration file and use it for TLS communication with the KMES Series 3.
  </Step>
</Steps>

##