Generate the intermediate CA key - Futurex Documentation

Generate the online intermediate CA key directly in the Smallstep service key store. The command returns only the public key.

Review the key policy

The Smallstep service pins these attributes:

Setting	Value	Reason
Algorithm	RSA	Matches the validated certificate-signing route
Size	3072 bits	Matches the validated key size
Protection	TRUSTED	Keeps the key encrypted under the HSM-protected key hierarchy
Usages	Sign and Verify	Restricts the key to the certificate-signing usage class
Extractable	No	Prevents private-key export

The template forces Sign/Verify because step-kms-plugin can request a broader RSA template than a TRUSTED key accepts.

Generate the key

Load the endpoint variables:

Shell

source /etc/step-ca/cryptohub.env
export CHLIBS_CONFIG

Confirm that STEP_INTERMEDIATE_KEY contains both the hexadecimal id and the object label. These values identify the same key in every later command. Generate the key:

Shell

step kms create \
  --kty RSA \
  --size 3072 \
  --kms "$STEP_KMS_URI" \
  "$STEP_INTERMEDIATE_KEY" \
  > /tmp/smallstep-intermediate-public.pem

The command prints or writes a PEM public key beginning with:

Expected result

-----BEGIN PUBLIC KEY-----

No private-key file appears on the step-ca host.

Confirm the key is reusable

Retrieve the public key again:

Shell

step kms key \
  --kms "$STEP_KMS_URI" \
  "$STEP_INTERMEDIATE_KEY" \
  > /tmp/smallstep-intermediate-public-check.pem

cmp \
  /tmp/smallstep-intermediate-public.pem \
  /tmp/smallstep-intermediate-public-check.pem

cmp produces no output and exits with status 0 when both commands resolved the same CryptoHub key.

Do not rerun step kms create with the same ID and label after the key exists. Use step kms key to retrieve its public key. To rotate the intermediate, choose a new ID and label and follow a planned CA rotation procedure.

​Review the key policy

​Generate the key

​Confirm the key is reusable

Review the key policy

Generate the key

Confirm the key is reusable