Validate the integration - Futurex Documentation

Issue a leaf certificate, verify its chain independently, restart the CA, and repeat the operation. This proves that step-ca uses the CryptoHub intermediate during normal issuance and after process restart.

Confirm CA health

Shell

export STEPPATH=/var/lib/smallstep/.step
export CA_PASSWORD_FILE=/var/lib/smallstep/ca-password.txt

curl --fail --silent \
  --cacert "$STEPPATH/certs/root_ca.crt" \
  https://localhost:9000/health | jq -e '.status == "ok"'

The command prints true and exits with status 0.

Issue the first leaf certificate

Shell

mkdir -p /var/lib/smallstep/issued

step ca certificate \
  service.example.com \
  /var/lib/smallstep/issued/service.crt \
  /var/lib/smallstep/issued/service.key \
  --provisioner admin \
  --provisioner-password-file "$CA_PASSWORD_FILE" \
  --ca-url https://localhost:9000 \
  --root "$STEPPATH/certs/root_ca.crt" \
  --not-after 24h \
  --force

The command reports that it saved the certificate and private key. The leaf private key belongs to the requesting service; it is separate from both CA keys. Inspect the issuer and verify the chain:

Shell

openssl x509 \
  -in /var/lib/smallstep/issued/service.crt \
  -noout -subject -issuer

openssl verify \
  -CAfile "$STEPPATH/certs/root_ca.crt" \
  -untrusted "$STEPPATH/certs/intermediate_ca.crt" \
  /var/lib/smallstep/issued/service.crt

The issuer is CryptoHub Smallstep Intermediate CA. OpenSSL prints:

Expected result

/var/lib/smallstep/issued/service.crt: OK

Confirm the CryptoHub signing operation

Shell

sudo grep -E 'C_SignInit|C_SignFinal' \
  /var/log/futurex/smallstep-chlibs.log | tail -8

The output includes C_SignInit and C_SignFinal calls from the issuance window. Confirm that the superseded software intermediate key is absent:

Shell

test ! -e "$STEPPATH/secrets/intermediate_ca_key"

The command exits with status 0. The root key remains encrypted on disk, while the active intermediate private key remains in CryptoHub.

Restart and repeat issuance

Shell

sudo docker restart stepca

for attempt in $(seq 1 30); do
  if curl --fail --silent \
    --cacert "$STEPPATH/certs/root_ca.crt" \
    https://localhost:9000/health | jq -e '.status == "ok"' >/dev/null; then
    break
  fi
  sleep 2
done

step ca certificate \
  service-after-restart.example.com \
  /var/lib/smallstep/issued/service-after-restart.crt \
  /var/lib/smallstep/issued/service-after-restart.key \
  --provisioner admin \
  --provisioner-password-file "$CA_PASSWORD_FILE" \
  --ca-url https://localhost:9000 \
  --root "$STEPPATH/certs/root_ca.crt" \
  --not-after 24h \
  --force

openssl verify \
  -CAfile "$STEPPATH/certs/root_ca.crt" \
  -untrusted "$STEPPATH/certs/intermediate_ca.crt" \
  /var/lib/smallstep/issued/service-after-restart.crt

OpenSSL prints the second certificate path followed by OK. A second pair of C_SignInit and C_SignFinal calls appears in the FxChlibs log. The integration is complete when both certificates verify and the CA remains healthy after restart.

​Confirm CA health

​Issue the first leaf certificate

​Confirm the CryptoHub signing operation

​Restart and repeat issuance

Confirm CA health

Issue the first leaf certificate

Confirm the CryptoHub signing operation

Restart and repeat issuance