Install FXPKCS11 on the same computer as the application that integrates with the HSM.
Extract the
.tar file locally where you want to install the application on your file system.For the Futurex PKCS #11 module to be accessible system-wide, an administrative user must place it to
/usr/local/lib. If only the current user needs to use the module, then installing it to $HOME/libis appropriate.The extracted content of the
.tar file is a single fxpkcs11 directory. This directory contains the following files and directories (only the files and folders relevant to the installation process are included in this list):| File name or directory | Description |
|---|---|
fxpkcs11.cfg | PKCS #11 configuration file to use for HSM integrations. |
fxpkcs11-kms.cfg | (You might not use this file.) PKCS #11 configuration file to use for KMES Series 3 integrations. |
x86/ | This folder contains the module files for the 32-bit architecture. |
x64/ | This folder contains the module files for the 64-bit architecture. |
The
x86 and x64 directories contain multiple directories named for the specific OpenSSL versions. These OpenSSL directories contain the PKCS #11 module files built with the respective OpenSSL versions.As of July 2025, Futurex doesn’t support OpenSSL 3.x on x84 (32-bit) systems.
| File name | Description |
|---|---|
configTest | Program to test the configuration and connection to the HSM. |
libfxpkcs11.so | PKCS #11 Library file. |
PKCS11Manager | Program to test the connection and manage the HSM through the PKCS #11 library. |
Set file permissions required by the installer
In the final section of this integration guide, the Zettaset XCrypt Full Disk installer script runs certain commands with the ztsca user. Because of this, the ztsca user must have full permissions on the FXPKCS11 module, configuration, and log files. The simplest way to do this is to make the pkcs11 group the owner of the FXPKCS11 files. The ztsca user is a part of this group. To make this configuration, execute the following commands:Shell