> ## Documentation Index > Fetch the complete documentation index at: https://docs.futurex.com/llms.txt > Use this file to discover all available pages before exploring further. # Smallstep step-ca > How Smallstep step-ca protects its online intermediate CA key with CryptoHub through the CryptoHub Client Library PKCS #11 module. export const SmallstepCryptoHubFlow = () => One-time CA setup Software root key encrypted on the CA host Intermediate certificate public certificate on the CA host signs once Certificate issuance Certificate requester service or workload step-ca HSM container direct PKCS #11 KMS CryptoHub client application service request sign over TLS signature only certificate Intermediate private key nonexportable in the HSM uses ; Smallstep step-ca is an online certificate authority for internal PKI. This integration keeps the online intermediate CA key in CryptoHub while step-ca issues X.509 certificates to services and workloads. ## The CA key model This guide uses two CA tiers: * The root key remains encrypted on the step-ca host. Use it only to sign the intermediate certificate, then protect it as an offline root. * The intermediate private key remains nonexportable in CryptoHub. The running CA uses this key for routine certificate issuance. The split keeps the frequently used signing key in the HSM without requiring step-ca to access the root key during normal operation. ## How it works The `smallstep/step-ca:0.30.2-hsm` container loads the endpoint-delivered `libcryptohub-pkcs11.so` module through Smallstep's native PKCS #11 KMS. The module authenticates from the protected UserPass credential in `cryptohub.json` and connects to CryptoHub over TLS on TCP 443. When step-ca issues a certificate: 1. The requester sends a certificate request to step-ca. 2. step-ca builds the certificate data and asks its PKCS #11 signer to sign it. 3. The CryptoHub Client Library sends the signing operation to the Smallstep service in CryptoHub. 4. CryptoHub uses the intermediate key in the HSM and returns only the signature. 5. step-ca assembles and returns the issued certificate. Neither CA private key travels to the requester or appears in the container filesystem. ## Why this route uses the HSM image Smallstep's standard `step-ca` release binary is compiled without CGO and rejects a PKCS #11 KMS. The `0.30.2-hsm` image includes the CGO-enabled CA and the step-kms-plugin needed to load a native PKCS #11 module. An OpenSSL provider is not part of this integration. step-ca loads the CryptoHub module directly through its own KMS configuration. ## Validated scope This guide covers: * CryptoHub 7.3.0.x build 7.3.0.0b or later in that branch. * Smallstep step-ca `0.30.2-hsm` on a Linux x86-64 Docker host. * step CLI 0.30.6 and step-kms-plugin 0.17.0. * One software root and one CryptoHub-backed RSA-3072 intermediate. * UserPass endpoint authentication over the CryptoHub REST API. * Leaf issuance, independent chain verification, and issuance after a container restart. High availability, ACME, SSH CA operation, key rotation, Windows, and a native source-built step-ca daemon are outside this guide.