Install and configure the Futurex Client Library EKM
The Futurex Client Library (FXCL) is a set of functions, offered through either Java (Java Native Interface) or C++, which applications use to access cryptographic processing and key management functionality.
To maintain system security, install and operate only copies of FXCL that you get directly from Futurex. A member of the Solutions Architect team provides these files directly or you can download them on the Futurex Portal or equivalent Futurex-operated file distribution platform.
Perform the following steps to install FXCL Expandable Key Management (EKM):
Download or copy the fxcl-x.x.x-win64.zip file to the computer that runs the Microsoft SQL Server instance.
Unzip the file in any directory and go to the fxcl-x.x.x-win64\bin folder.
Copy ekm.config.json and libfxcl-ekm.dll to C:\Program Files\Futurex\fxcl\kmes\ekm\ and change the name of the ekm.config.json file to config.json.
Create the C:\FX-Logs directory. The FXCL EKM configuration file outputs content to FXCL EKM logs to the C:\FX-Logs\ directory.
Open the config.json file for editing, and make the following changes:
Parameter
Required configuration
log_file
Set the define to point to the C:\FX-LOGS\fxcl-ekm.log directory
host
Set the define to point to the IP and port of the network-connected KMES Series 3 device
In the Windows Store TLS settings section, make the following changes as shown in the following sample file:
Parameter
Required configuration
win_cert_store
Set the define to point to the My, which corresponds with the Personal store.
win_cert_name
Set the define to the Common or Subject Name of the Microsoft SQL Server certificate.
win_ca_stores
Set the define to the Root store, which corresponds with the Trusted Root Certification Authorities store.
win_use_crl
Set the define to true.
The ca, p12, and p12_pass file TLS Setting defines are not included in the preceding sample configuration file because this guide uses the Windows Store TLS authentication method. However, the Windows Store TLS settings take precedence if both are defined.