Install and configure Futurex PKCS #11

install futurex pkcs #11 (fxpkcs11) on all computers running openvpn components ( access server or connect v3 ) that you want to integrate with {{ch}} at a minimum, you need to install futurex pkcs #11 on the machine where openvpn access server is installed however, if you are integrating multiple openvpn connect clients with {{ch}} , futurex pkcs #11 must be installed on each individual openvpn connect client machine windows perform the following instructions to install fxpkcs11 on windows extract the endpoint zip file downloaded in your browser when deploying a client endpoint for the service the zip file contains the following files pkcs11manager exe program to test the connection to the {{ch}} and perform basic functions through the fxpkcs11 module, such as logging in and generating random data ca chain pem ca certificate bundle client cert pem client tls certificate client p12 full client pki in encrypted pkcs #12 format (contains the ca chain, client certificate, and client private key) configtest exe program to test the configuration and connection to the {{ch}} fxpkcs11 cfg configuration file for the {{futurex}} pkcs #11 library fxpkcs11 dll the {{futurex}} pkcs #11 library file move all of the preceding fxpkcs11 files to c \program files\futurex\fxpkcs11 create the futurex\fxpkcs11 directory as an administrator the {{futurex}} pkcs #11 module expects to find the fxpkcs11 configuration file ( fxpkcs11 cfg ) in the c \program files\futurex\fxpkcs11 directory by default alternatively, you can set the fxpkcs11 cfg environment variable to point to the location of the fxpkcs11 configuration file to store it in a different location linux and macos perform the following instructions to install fxpkcs11 on linux or macos (the instructions are the same) extract the zip file downloaded from {{ch}} the zip file contains the following files pkcs11manager program to test the connection to the {{ch}} and perform basic functions through the fxpkcs11 module, such as logging in and generating random data ca chain pem ca certificate bundle client cert pem client tls certificate client p12 full client pki in encrypted pkcs #12 format (contains the ca chain, client certificate, and client private key) configtest program to test the configuration and connection to the {{ch}} fxpkcs11 cfg configuration file for the {{futurex}} pkcs #11 library libfxpkcs11 so the {{futurex}} pkcs #11 library file move all the preceding files to one of the following locations to make the fxpkcs11 library accessible system wide, use sudo to move the files to the /usr/local/lib/fxpkcs11 directory to make the fxpkcs11 library accessible only for the current user, move the files to the $home/bin/fxpkcs11 directory important the {{futurex}} pkcs #11 module expects the configuration file ( fxpkcs11 cfg ) to be in the /etc directory by default use the following command to move fxpkcs11 cfg to /etc sudo mv fxpkcs11 cfg /etc/ alternatively, to store the configuration file in a different location, set the fxpkcs11 cfg environment variable to the path of your configuration file export fxpkcs11 cfg=/path/to/your/fxpkcs11 cfg you can find the pkcs11 pin in the \<crypto opr pass> parameter in the {{futurex}} pkcs #11 configuration file ( fxpkcs11 cfg ) for pkcs #11 integrations that enable you to define the pkcs11 pin inside the integrating application, we recommend removing the \<crypto opr pass> line from the fxpkcs11 configuration file