Skip to main content
Generate the CA signing key on CryptoHub with hwsetup, the key setup tool that ships with Certificate Manager. The key pair is generated on the appliance, and Certificate Manager uses it later as an existing key when you create the CA.

​
Key requirements

The key ID and label are examples. Choose values that fit your naming scheme, and use the same key ID in every later step.

​
Open the tool

1
Open Command Prompt (cmd.exe). Do not use PowerShell.
2
Change to the tools directory of the Nexus tool package:
Command Prompt
Replace C:\path\to\Tools with the location of the Nexus tool package, or with the tools directory of your Certificate Manager installation.
3
Run hwsetup.bat with no arguments to display the available commands:
Command Prompt
The tool prints its usage summary, which includes the -libname, -slot, -pin, -list, and -genrsa options.
hwsetup takes the PKCS #11 PIN as a command-line argument. Anything typed on the command line can appear in console history and in the process list of the host. Run these commands on the Certificate Manager host only, close the Command Prompt window when you finish, and replace YOUR_PIN in each command with the PIN you recorded from CRYPTO-OPR-PASS.

​
Test connectivity and authentication

Confirm hwsetup can load the Futurex library, log in to the CryptoHub slot, and read the token:
Command Prompt
The tool reports slot 0 with the token name Futurex, lists the IDs of any key objects already in the service key group, and ends with Done.:
Output
This confirms that hwsetup loads the Futurex PKCS #11 library, authenticates, and enumerates the key IDs on the token.

​
Generate the RSA key pair

Run the key generation command:
Command Prompt
The tool reports the key generation and completes:
Output
The options set the following attributes:
  • -genrsa 4096 generates an RSA key pair of 4096 bits.
  • -id sets CKA_ID on both keys. Certificate Manager uses this ID to associate the key with certificate requests and certificates.
  • -label sets CKA_LABEL.
  • -sign sets CKA_SIGN on the private key and CKA_VERIFY on the public key.
Always pass -sign when you generate a CA key. Without a usage option, hwsetup requests sign, decrypt, and unwrap usage together on one key pair. Keep the key nonexportable: do not pass -extractable.
If a key with the same ID already exists, hwsetup does not replace it. The -force option replaces an existing key with the same ID. Do not use -force against a key that already backs a CA, because the CA can no longer sign with a replaced key.

​
List the keys on CryptoHub

List the key objects and their attributes to confirm the new key pair:
Command Prompt
The output lists the key ID with a private RSA key that permits CKA_SIGN and a public RSA key that permits CKA_VERIFY, with the key length and label you set:
Output

​
Confirm the key in CryptoHub

1
Log in to the CryptoHub and go to Key Management.
2
Select the key group for the service you deployed. Its name is the service name followed by -Asym, for example Nexus PKI-Asym.
3
Find the key in the Keys list.
The Name column starts with the label you set, followed by the key ID and a numeric suffix, for example Nexus-RSA-Futurex_nexus-ca-rsa_<number>. The Algorithm column shows RSA-4096.
Record the key ID. You select it in Certificate Manager in the next step.