Edit the Futurex PKCS #11 Configuration File

the {{futurex}} pkcs #11 library uses the {{futurex}} pkcs #11 configuration file, fxpkcs11 cfg , to connect to the hsm it enables you to modify certain configurations and set connection details this section covers the \<hsm> portion of the fxpkcs11 configuration file where you configure the connection details by default, the fxpkcs11 library looks for the configuration file in c \program files\futurex\fxpkcs11\fxpkcs11 cfg for windows and /etc/fxpkcs11 cfg for linux alternatively, you can set the fxpkcs11 cfg environment variable to the location of the fxpkcs11 cfg file open the fxpkcs11 cfg file in a text editor as an administrator and edit it accordingly \<hsm> \# which pkcs11 slot \<slot> 0 \</slot> \<label> futurex \</label> \# hsm crypto operator user name \<crypto opr> \[identity name] \</crypto opr> \# automatically login on session open \<crypto opr pass> \[identity password] \</crypto opr pass> \# connection information \<address> \[hsm ip address] \</address> \<prod port> 9100 \</prod port> \<prod tls enabled> yes \</prod tls enabled> \<prod tls anonymous> no \</prod tls anonymous> \# \<prod tls ca> /home/user/tls/root pem \</prod tls ca> \# \<prod tls ca> /home/user/tls/sub1 pem \</prod tls ca> \# \<prod tls ca> /home/user/tls/sub2 pem \</prod tls ca> \<prod tls key> /home/user/tls/pki p12 \</prod tls key> \<prod tls key pass> safest \</prod tls key pass> \# yes = this is communicating through a guardian \<fx load balance> no \</fx load balance> \</hsm> field description \<slot> leave it set to the default value of 0 \<label> leave it set to the default value of futurex \<crypto opr> specify the name of the identity created for the application partition \<crypto opr pass> s pecify the password of the identity configured in the \<crypto opr> field you can use this to log the application into the hsm automatically if necessary \<address> specify the ip address of the hsm to which the pkcs #11 library should connect \<prod port> set the port number of the hsm to which the fxpkcs11 library should connect \<prod tls enabled> set the field to yes \<prod tls anonymous> defines whether the fxpkcs11 library authenticates to the server \<prod tls key> set the location of the client private key we support the following formats for the tls private key pkcs #1 clear private keys pkcs #8 encrypted private keys a pkcs #12 file that contains the private key and certificates encrypted under a password because the \<prod tls key> field in this example defines a pkcs #12 file, you do not need to define the signed client cert with the \<prod tls cert> tag, nor the ca certificates with one or more instances of the \<prod tls ca> tag \<prod tls key pass> set the password of the pkcs #12 file, if necessary \<fx load balance> i f you use a guardian to manage hsm devices in a cluster, set this field to yes if you don't use a guardian, set it to no after you finish editing the fxpkcs11 cfg file, run the pkcs11manager file to test the connection against the hsm, and check the fxpkcs11 log for errors and information for more information, see the {{futurex}} pkcs #11 technical reference found on the {{futurex}} portal special compatibility mode configuration required for this integration for this integration, add the following defines in the \<config> section of the fxpkcs11 cfg file the hsm demo and hsm hmac demo key labels correspond with the values for for the key label and hmac key label values in the vault hcl file \<forced label usage> hsm demo = encrypt | decrypt \</forced label usage> \<forced label usage> hsm hmac demo = sign | verify \</forced label usage> these defines force speciifc usages for the two keys that vault creates on the hsm, based on the key labels that are specified