> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Edit the Futurex PKCS #11 configuration file

> Procedural guide to editing the Futurex PKCS #11 config file for Bitwarden integration.

Perform the following tasks to configure the PKCS #11 file for this integration:

## Define the connection information

The `fxpkcs11.cfg` file enables you to set the Futurex PKCS #11 library to connect to the KMES Series 3. To edit the file, run a text editor as an Administrator on Windows or as root on Linux, and edit the configuration file accordingly. Most notably, you must set the fields described in this section inside the `<KMS>` section of the file.

Our PKCS #11 library expects to find the PKCS #11 config file in a certain location `(C:\Program Files\Futurex\fxpkcs11\fxpkcs11.cfg` for Windows and `/etc/fxpkcs11.cfg `for Linux), but you can override that location by using the **FXPKCS11\_CFG** environment variable.

To configure the `fxpkcs11.cfg` file, edit the following sections of the partial file sample:

```none expandable lines wrap title="None" theme={null}
<KMS>
    # Which PKCS11 slot
    <SLOT>                  0                       </SLOT>
    <LABEL>                 Futurex                 </LABEL>

    # Login username
    <CRYPTO-OPR>            Bitwarden                 </CRYPTO-OPR>

    # Connection information
    <ADDRESS>               10.0.8.20 </ADDRESS>
    <PROD-PORT>             2001                    </PROD-PORT>
    <PROD-TLS-ENABLED>      YES                     </PROD-TLS-ENABLED>
    <PROD-TLS-ANONYMOUS>    NO                      </PROD-TLS-ANONYMOUS>
    <PROD-TLS-KEY>          /home/futurex/tls/client.p12   </PROD-TLS-KEY>
    <PROD-TLS-KEY-PASS>     P12_Pas                 </PROD-TLS-KEY-PASS>

    # YES = This is communicating through a Guardian
    <FX-LOAD-BALANCE>       NO                      </FX-LOAD-BALANCE>
</KMS>
```

<table>
  <thead>
    <tr>
      <th><em><strong>Field</strong></em></th>
      <th><em><strong>Description</strong></em></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>\<SLOT></code></td>
      <td>Can leave set to the default value of <code>0</code>.</td>
    </tr>

    <tr>
      <td><code>\<LABEL></code></td>
      <td><code>Can leave set to the default value of </code><code>Futurex</code><code>.</code></td>
    </tr>

    <tr>
      <td><code>\<CRYPTO-OPR></code></td>
      <td>Specify the name of the<strong> identity</strong> created on the KMES. </td>
    </tr>

    <tr>
      <td><code>\<ADDRESS></code></td>
      <td>Specify the <strong>IP address</strong> of the KMES to which the PKCS #11 library should connect.</td>
    </tr>

    <tr>
      <td><code>\<LOG-FILE></code></td>
      <td>Set the path of the PKCS #11 log file. Find it at the top of the file.</td>
    </tr>

    <tr>
      <td><code>\<PROD-PORT></code></td>
      <td>Set the PKCS #11 library to connect to the default Host API port on the KMES, port <code>2001</code><strong>.</strong></td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-ENABLED></code></td>
      <td>Set the field to <strong>YES</strong>. The only way to connect to the Host API port on the KMES is over TLS.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-ANONYMOUS></code></td>
      <td>Set this value to <strong>NO</strong> because you're connecting to the Host API port by using mutual authentication. This field defines whether the PKCS #11 library authenticates to the KMES. </td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-KEY></code></td>
      <td>Set the location of the client PKCS #12 file, which contains the private key and certificates encrypted under a password.</td>
    </tr>

    <tr>
      <td><code>\<PROD-TLS-KEY-PASS></code></td>
      <td>Set the password of the PKCS #12 file.</td>
    </tr>

    <tr>
      <td><code>\<FX-LOAD-BALANCE></code></td>
      <td>Set this field to <strong>YES</strong> if you use a Guardian to manage KMES Series 3 devices in a cluster. <br />If you don't use a Guardian, set it to <strong>NO</strong></td>
    </tr>
  </tbody>
</table>

For additional details, see the Futurex PKCS #11 technical reference on the Futurex Portal.

## Test the connection

After you edit the `fxpkcs11.cfg` file, run the `PKCS11Manager` file to test the connection against the KMES. Check the `fxpkcs11.log` for errors and information.

For more information, see our Administrator Guide.