> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Certificate Manager

> Register CryptoHub as a PKCS #11 device in Nexus Certificate Manager, create a CA key from the CryptoHub-resident key pair, and create the CA.

Configure Certificate Manager to sign with the key you generated on CryptoHub. You register CryptoHub as a key storage device for the Certificate Issuing System (CIS), register the existing key pair as a CA key, and create the CA that uses it.

The Certificate Manager tasks on this page follow the Nexus procedures for Certificate Manager. For the full field reference, refer to [Create CA key in Certificate Manager](https://doc.nexusgroup.com/nexus-certificate-manager/8.15/create-ca-key-in-certificate-manager) and [Create CA in Certificate Manager](https://doc.nexusgroup.com/nexus-certificate-manager/8.15/create-ca-in-certificate-manager).

## Register CryptoHub as a CIS device

<Steps>
  <Step>
    Make the Nexus PKCS #11 bridge available to Certificate Manager.

    Certificate Manager loads PKCS #11 libraries through the 64-bit `jpkcs11.dll` bridge. Place `jpkcs11.dll` in a folder on the system `PATH`, as described in the Nexus installation instructions for your Certificate Manager version.
  </Step>

  <Step>
    Add a PKCS #11 device to the CIS configuration (`cis.conf`) with the following values:

    | Setting | Value |
    | - | - |
    | PKCS #11 library | `C:\Program Files\Futurex\fxpkcs11\fxpkcs11.dll` |
    | Slot | `0` |
    | PIN | The PKCS #11 PIN you recorded from `CRYPTO-OPR-PASS` |

    Nexus Group provides the device syntax for `cis.conf` with Certificate Manager. If you do not have it, contact Nexus support.
  </Step>

  <Step>
    Sign the changed CIS configuration file with an administration officer that holds the **Configuration tasks** role, then restart Certificate Manager.

    An unsigned configuration change starts Certificate Manager in maintenance mode. For details, refer to [Sign CF and CIS configuration files in Certificate Manager](https://doc.nexusgroup.com/nexus-certificate-manager/8.15/sign-cf-and-cis-configuration-files-in-certificate-manager).
  </Step>
</Steps>

## Create the CA key

Two administration officers with the **Use AWB** and **CA and Key tasks** roles sign this task.

<Steps>
  <Step>
    In the Administrator's workbench (AWB), select **New** > **Key**.
  </Step>

  <Step>
    In the **Create Key Request** dialog, enter a **Key name**, for example `Nexus-RSA-Futurex`. The name appears in the **Key Registry**.
  </Step>

  <Step>
    Set **State** to **Active**, then select the **Domain**.
  </Step>

  <Step>
    Select the **Authority type** **CA/SA**.
  </Step>

  <Step>
    In **Type of key**, select the option to use an existing key in the device.

    The key already exists on CryptoHub, so Certificate Manager registers it rather than generating a new one.
  </Step>

  <Step>
    In **Device**, select the CryptoHub device you added to the CIS configuration.

    <Check>
      The dialog shows the key algorithm and key operations of the CryptoHub device.
    </Check>
  </Step>

  <Step>
    In **Existing key ID**, select the key ID you set with `hwsetup`, for example `nexus-ca-rsa`.

    The list contains only keys that are not already in use by a CA.
  </Step>

  <Step>
    Select **\[ OK ]** and sign the task with both officers.

    <Check>
      The key appears in the **Key Registry** under the name you entered.
    </Check>
  </Step>
</Steps>

## Create the CA

<Steps>
  <Step>
    In AWB, select **New** > **Authority**.
  </Step>

  <Step>
    In the **Create Authority Request** dialog, enter the **Authority name**, set **State** to **Active**, select the **Domain**, and select the **Authority type** **CA**.
  </Step>

  <Step>
    Set **Valid from** and **Expiration date**.
  </Step>

  <Step>
    Select the issuing CA:

    * **Root CA**: Keep **Issuing CA - Self signed** selected.
    * **Subordinate CA**: Clear **Issuing CA - Self signed**, select the browse button next to **Issuing CA**, and select the CA that issues this CA.
  </Step>

  <Step>
    Under **CA Usage**, select **Certificate signing** and, if this CA publishes CRLs, **CRL signing**.
  </Step>

  <Step>
    In **Key**, select the browse button and select the CA key you created in the previous section.
  </Step>

  <Step>
    Select the **Key algorithm** and **Signature algorithm**, for example an RSA SHA-256 signature algorithm.
  </Step>

  <Step>
    In **Format**, select the certificate format, for example `rfc5280`, and add any distribution rules your CA requires.
  </Step>

  <Step>
    Enter the certificate attributes. In **Common Name**, enter the CA name that appears in the CA certificate, for example `Nexus-RSA-Futurex`.
  </Step>

  <Step>
    Select **\[ OK ]** and sign the task with both officers.

    <Check>
      The CA appears in the **Authority Hierarchy**. Certificate Manager signs the CA certificate, or the subordinate CA request, with the CryptoHub-resident key.
    </Check>
  </Step>
</Steps>

Configure the certificate procedures that issue end-entity certificates from this CA, for example the TLS server certificate procedure that Smart ID Self-Service requests use. Certificate Manager signs every certificate those procedures issue with the CryptoHub-resident CA key.