> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Excrypt Touch

> Procedures for configuring Excrypt Touch and establishing KMES connection profiles.

This section covers how to configure the Excrypt Touch and then use the Excrypt Touch to connect the KMES Series 3 to the platform and configure additional items related to user roles and identities.

Perform the following tasks after logging in locally to the Excrypt Touch with the default admin identities.

## Set major keys

Refer to the Excrypt Touch User Guide for instructions on how to load major keys on the Excrypt Touch.

<Warning>
  You must load the same PMK and BEK on the KMES Series 3 and Excrypt Touch. Ensure that the key checksums match.
</Warning>

## Create a KMES connection profile

Perform the following steps to create a KMES connection profile:

<Steps>
  <Step>
    From the **Excrypt Touch Dashboard**, select the **Add Device** button represented by the plus sign (**+**) located underneath your active servers and to the left.
  </Step>

  <Step>
    In the **Add Device** window, enter the following required information:

    <table>
      <thead>
        <tr>
          <th><em><strong>Configuration setting</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Name</strong></td>
          <td>An appropriate device name.</td>
        </tr>

        <tr>
          <td><strong>Host</strong></td>
          <td>The host IP address of your device</td>
        </tr>

        <tr>
          <td><strong>Description</strong></td>
          <td>Optional field to describe your device</td>
        </tr>

        <tr>
          <td><strong>Port</strong></td>
          <td>An example port is port <code>5000</code>, which is the default port for Futurex devices. The port number must match the port number in the TLS settings for the device you are connecting to.</td>
        </tr>

        <tr>
          <td><strong>Enabled</strong></td>
          <td>Select <strong>Enabled </strong>from the drop-down menu. After the device connects, you can also choose <strong>Disable</strong>, <strong>Require Dual-Control</strong>, <strong>Require Login</strong>, and <strong>Run on Boot</strong>.</td>
        </tr>

        <tr>
          <td><strong>Device Type</strong></td>
          <td>Select the type of Futurex device you are connecting to from the drop-down menu. In this example, choose <strong>KMES Series 3 Enterprise</strong>.</td>
        </tr>

        <tr>
          <td><strong>Connection Type</strong></td>
          <td>If connecting to a Futurex device, choose <strong>Application </strong>and choose <strong>Futurex Web</strong> when connecting to a web service.</td>
        </tr>

        <tr>
          <td><strong>TLS PKI</strong></td>
          <td>Select the connection method from the following list:<ul><li><strong>Clear</strong>: No Authentication</li><li><strong>Anonymous</strong>: Anonymous authentication</li><li><strong>User</strong>: Use user-provided PKI certificates</li><li><strong>Server authenticate</strong>: Authenticate server only</li><li><strong>Futurex admin</strong>: Use Futurex-signed certificates to connect </li></ul>For this example, select <strong>Futurex admin</strong>.</td>
        </tr>

        <tr>
          <td><strong>PKI Type</strong></td>
          <td>If using Futurex certificates, select <strong>RSA</strong> or <strong>ECC</strong>.</td>
        </tr>

        <tr>
          <td><strong>TLS Ciphers/ TLS Protocols</strong></td>
          <td>Choose the desired TLS Ciphers and TLS Protocols.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    Select **\[ Submit ]**.

    <Check>
      Your newly added device profile displays under the list of devices and services in the Excrypt Touch Dashboard.
    </Check>
  </Step>

  <Step>
    Make the following changes to the device now displayed in the connected devices in the **Offline** column:

    * Select **Modify** if you'd like to edit the device profile.
    * Select **Test** to verify the connectivity of the device (must have a valid IP address).
      * Choose **Ping** to send a packet test to the device.
      * Choose **Retry** to re-run the test.
  </Step>
</Steps>

## Create a printer profile

Perform the following steps to create a printer profile:

<Steps>
  <Step>
    From the **Excrypt Touch Dashboard**, select the **Add Device** button represented by the plus sign located underneath your active servers to the left.
  </Step>

  <Step>
    Enter all of the required information in the **Add Device** window:

    <table>
      <thead>
        <tr>
          <th><em><strong>Configuration setting</strong></em></th>
          <th><em><strong>Description</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Name</strong></td>
          <td>An appropriate device name.</td>
        </tr>

        <tr>
          <td><strong>Host</strong></td>
          <td>The host IP of your device</td>
        </tr>

        <tr>
          <td><strong>Description</strong></td>
          <td>Optional field to describe your device</td>
        </tr>

        <tr>
          <td><strong>Port</strong></td>
          <td>The value specified in this field needs to be either port <code>80</code> or <code>443</code> because the Excrypt Touch connects to a web server that runs on the printer.</td>
        </tr>

        <tr>
          <td><strong>Enabled</strong></td>
          <td>Select <strong>Require Login </strong>from the drop-down menu. </td>
        </tr>

        <tr>
          <td><strong>Device Type</strong></td>
          <td>Select<strong> Encrypted File Printing</strong> from the drop-down menu.</td>
        </tr>

        <tr>
          <td><strong>Connection Type</strong></td>
          <td>Because this profile is for connecting to a web service on the printer, select <strong>External Web</strong> from the drop-down menu.</td>
        </tr>

        <tr>
          <td><strong>TLS PKI</strong></td>
          <td>Select the method used to connect. The options include the following:<ul><li><strong>Clear:</strong> No Authentication</li><li><strong>Anonymous</strong>: Anonymous authentication</li><li><strong>User</strong>: Use user-provided PKI certificates</li><li><strong>Server authenticate</strong>: Authenticate server only</li><li><strong>Futurex admin</strong>: Use Futurex-signed certificates to connect </li></ul>For this example, select <strong>Futurex Admin</strong>.</td>
        </tr>

        <tr>
          <td><strong>PKI Type</strong></td>
          <td>If using Futurex certificates, select <strong>RSA</strong> or <strong>ECC</strong>.</td>
        </tr>

        <tr>
          <td><strong>TLS Ciphers/ TLS Protocols</strong></td>
          <td>Choose the desired TLS Ciphers and TLS Protocols.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    Select **\[ Submit ]**.

    <Check>
      Your newly added device profile displays under the list of devices and services in the Excrypt Touch Dashboard.
    </Check>
  </Step>

  <Step>
    Make the following changes to the device now displayed in the connected devices in the **Offline** column:

    * Select **Modify** if you'd like to edit the device profile.
    * Select **Test** to verify the connectivity of the device (must have a valid IP address).
      * Choose **Ping** to send a packet test to the device.
      * Choose **Retry** to re-run the test.
  </Step>
</Steps>

## Start the KMES profile and log in

Use the Excrypt Touch to remotely connect to your KMES and make the following additional configuration changes:

<Steps>
  <Step>
    To start the KMES Series 3 Connection Profile, touch the **arrow** next to the device profile.

    <Check>
      The device comes online and shows in the online column.
    </Check>
  </Step>

  <Step>
    When the device is online, you can access the application manager for that device and communicate with the device as needed. Select **\[ Go ]** in the right column to access the connected device.
  </Step>

  <Step>
    After the application manager loads, log in with the default admin identities.
  </Step>
</Steps>

### Create a user role

Perform the following steps to create a user role:

<Steps>
  <Step>
    Go to the **Roles** menu, and select **\[ Add ]**.
  </Step>

  <Step>
    On the **Info** tab of the **Role Editor** window, configure the following settings:

    <table>
      <thead>
        <tr>
          <th><em><strong>Setting</strong></em></th>
          <th><em><strong>Required configuration</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Type</strong></td>
          <td>Administration</td>
        </tr>

        <tr>
          <td><strong>Name</strong></td>
          <td>Printers</td>
        </tr>

        <tr>
          <td><strong>Hardened</strong></td>
          <td>Select the checkbox to enable</td>
        </tr>

        <tr>
          <td><strong>Logins Required</strong></td>
          <td>Set to <code>2</code></td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    Go to the **Permissions** tab and enable the following permissions:

    <table>
      <thead>
        <tr>
          <th><em><strong>Permission</strong></em></th>
          <th><em><strong>Subpermissions to enable</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Device</strong></td>
          <td>Enable the following subpermissions:<ul><li>FTP Server</li><li>Power Control</li><li>Zeroize</li></ul></td>
        </tr>

        <tr>
          <td><strong>Excrypt Touch</strong></td>
          <td>Enable all subpermissions</td>
        </tr>

        <tr>
          <td><strong>File Encryption</strong></td>
          <td>Enable all subpermissions</td>
        </tr>

        <tr>
          <td><strong>File Encryption Management</strong></td>
          <td>Enable all subpermissions</td>
        </tr>

        <tr>
          <td><strong>Identity</strong></td>
          <td>Enable all subpermissions</td>
        </tr>

        <tr>
          <td><strong>High-level Keys</strong></td>
          <td>Enable</td>
        </tr>

        <tr>
          <td><strong>Keys</strong></td>
          <td>Enable the following subpermissions:<ul><li>Add</li><li>Delete</li><li>Export</li><li>Import Components</li></ul></td>
        </tr>

        <tr>
          <td><strong>Major Keys</strong></td>
          <td>Enable the following subpermissions:<ul><li>Clear</li><li>Load</li></ul></td>
        </tr>

        <tr>
          <td><strong>High-level Role </strong></td>
          <td>Enable all subpermissions</td>
        </tr>

        <tr>
          <td><strong>Security</strong></td>
          <td>Enable the following subpermissions:<ul><li>Key Settings</li><li>Password Settings</li><li>Secure Mode</li><li>TLS Resign</li></ul></td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the new role.
  </Step>
</Steps>

### Create new identities

Perform the following steps to create new identities:

<Steps>
  <Step>
    Go to the **Identities** menu, right-click the blank whitespace, and select **Add > User**.
  </Step>

  <Step>
    On the **Info** tab of the **Role Editor** dialog, configure the following settings:

    <table>
      <thead>
        <tr>
          <th><em><strong>Setting</strong></em></th>
          <th><em><strong>Required configuration</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Type</strong></td>
          <td>Administration</td>
        </tr>

        <tr>
          <td><strong>Name</strong></td>
          <td>print1</td>
        </tr>

        <tr>
          <td><strong>Hardened</strong></td>
          <td>Select the checkbox to enable.</td>
        </tr>

        <tr>
          <td><strong>Locked</strong></td>
          <td>Leave unchecked.</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    On the **Assigned Roles** tab, select the printers role that you created in the previous section.
  </Step>

  <Step>
    On the **User Login** tab, set a password for the identity.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the first new identity.
  </Step>

  <Step>
    Right-click the blank whitespace on the **Identities** menu, then select **Add**> **User**.
  </Step>

  <Step>
    On the **Info** tab of the **Role Editor** dialog, replicate the settings from step 2, but set **print2** in the **Name** field this time.
  </Step>

  <Step>
    On the **Assigned Roles** tab, select the printers role that you created in the previous section.
  </Step>

  <Step>
    On the **User Login** tab, set a password for the identity.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the second new identity.
  </Step>
</Steps>

### Synchronize users between the KMES and Excrypt Touch

<Steps>
  <Step>
    Go to the **Roles** menu and select **\[ Excrypt Touch Sync ]**.
  </Step>

  <Step>
    When prompted to log in to the local HSM of the Excrypt Touch, log in with the default admin identities.

    <Check>
      After logging successfully, a message box informs you that tablet users have been synced successfully.
    </Check>
  </Step>

  <Step>
    For further confirmation that users and identities synced successfully, log in to the Excrypt Touch by using the **print1** and **print2** identities that you created on the KMES in the previous section.
  </Step>
</Steps>