Edit the Futurex CNG Configuration File
The Futurex CNG configuration file (i.e., fxcng.cfg) is used by the Futurex CNG library to connect to the HSM. It enables the user to modify certain configurations and set connection details. This section covers the <HSM> portion of the FXCNG config file, where the connection details are set.
By default, the FXCNG library looks for the configuration file at C:\Program Files\Futurex\fxcng\fxcng.cfg. Alternatively, the FXCNG_CFG environment variable can be set to the location of the fxcng.cfg file.
Open the fxcng.cfg file in a text editor as an administrator and edit it accordingly.
Field
Description
<SLOT>
Leave set to the default value of 0.
<LABEL>
Leave set to the default value of Futurex.
<CRYPTO-OPR>
Specify the name of the identity created for the Application Partition..
<CRYPTO-OPR-PASS>
specify the password of the identity configured in the <CRYPTO-OPR> field. This can be used to log the application into the HSM automatically, if required.
<ADDRESS>
Specify the IP address of the HSM to which the FXCNG library should connect.
<PROD-PORT>
Set the port number of the HSM that the FXCNG library should connect to.
<PROD-TLS-ENABLED>
Set the field to YES.
<PROD-TLS-ANONYMOUS>
Defines whether the FXPKCS11 library authenticates to the server.
<PROD-TLS-ENGINE>
Setting the define to "WINDOWS" specifies the TLS connection certificate is saved in Windows Certificate Store rather than the local file system.
<PROD-TLS-WIN-STORE>
Specifying "My" in this field tells the FXCNG library to look for the TLS client certificate in the "Personal" Windows Certificate Store.
<PROD-TLS-KEY>
Specifies the Common Name of the TLS client certificate.
<PROD-TLS-CA>
Multiple instances of this define may be used to specify where the CA certificate(s) are saved in the file system. FXCNG does not pull CAs from the Windows Certificate Store.
<FX-LOAD-BALANCE>
Set this field to YES if you use a Guardian to manage HSM devices in a cluster. If you don't use a Guardian, set it to NO
Once you finish editing the fxcng.cfg file, run the CNGInstallUtil file to test the connection against the HSM and check the FxCNG-Install-Log.txt file for errors and information.