> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate the CA key with hwsetup

> Use the Nexus hwsetup tool to connect to CryptoHub through Futurex PKCS #11, generate the RSA CA key pair, and confirm the key on the appliance.

Generate the CA signing key on CryptoHub with `hwsetup`, the key setup tool that ships with Certificate Manager. The key pair is generated on the appliance, and Certificate Manager uses it later as an existing key when you create the CA.

## Key requirements

| Setting | Example value | Purpose |
| - | - | - |
| Key ID (`CKA_ID`) | `nexus-ca-rsa` | Certificate Manager selects the key by this ID. |
| Label (`CKA_LABEL`) | `Nexus-RSA-Futurex` | Identifies the key in `hwsetup` listings and in CryptoHub **Key Management**. |
| Key type | RSA | |
| Key size | `4096` | Size of the CA key. Use the size your CA policy requires. |
| Usage | Sign and verify | A CA key only signs certificates and certificate revocation lists (CRLs). |

<Note>
  The key ID and label are examples. Choose values that fit your naming scheme, and use the same key ID in every later step.
</Note>

## Open the tool

<Steps>
  <Step>
    Open Command Prompt (`cmd.exe`). Do not use PowerShell.
  </Step>

  <Step>
    Change to the `tools` directory of the Nexus tool package:

    ```shell expandable lines wrap title="Command Prompt" theme={null}
    cd /d "C:\path\to\Tools\tools"
    ```

    Replace `C:\path\to\Tools` with the location of the Nexus tool package, or with the `tools` directory of your Certificate Manager installation.
  </Step>

  <Step>
    Run `hwsetup.bat` with no arguments to display the available commands:

    ```shell expandable lines wrap title="Command Prompt" theme={null}
    hwsetup.bat
    ```

    <Check>
      The tool prints its usage summary, which includes the `-libname`, `-slot`, `-pin`, `-list`, and `-genrsa` options.
    </Check>
  </Step>
</Steps>

<Warning>
  `hwsetup` takes the PKCS #11 PIN as a command-line argument. Anything typed on the command line can appear in console history and in the process list of the host. Run these commands on the Certificate Manager host only, close the Command Prompt window when you finish, and replace `YOUR_PIN` in each command with the PIN you recorded from `CRYPTO-OPR-PASS`.
</Warning>

## Test connectivity and authentication

Confirm `hwsetup` can load the Futurex library, log in to the CryptoHub slot, and read the token:

```shell expandable lines wrap title="Command Prompt" theme={null}
hwsetup.bat -libname "C:\Program Files\Futurex\fxpkcs11\fxpkcs11.dll" -slot 0 -pin "YOUR_PIN"
```

<Check>
  The tool reports slot `0` with the token name `Futurex`, lists the IDs of any key objects already in the service key group, and ends with `Done.`:

  ```text expandable lines wrap title="Output" theme={null}
  Slot: 0, Token: Futurex ID: <key-id> ... Done.
  ```
</Check>

This confirms that `hwsetup` loads the Futurex PKCS #11 library, authenticates, and enumerates the key IDs on the token.

## Generate the RSA key pair

Run the key generation command:

```shell expandable lines wrap title="Command Prompt" theme={null}
hwsetup.bat -libname "C:\Program Files\Futurex\fxpkcs11\fxpkcs11.dll" -slot 0 -pin "YOUR_PIN" -genrsa 4096 -id nexus-ca-rsa -label "Nexus-RSA-Futurex" -sign
```

<Check>
  The tool reports the key generation and completes:

  ```text expandable lines wrap title="Output" theme={null}
  Generating RSA key pair...
  Done.
  ```
</Check>

The options set the following attributes:

* `-genrsa 4096` generates an RSA key pair of 4096 bits.
* `-id` sets `CKA_ID` on both keys. Certificate Manager uses this ID to associate the key with certificate requests and certificates.
* `-label` sets `CKA_LABEL`.
* `-sign` sets `CKA_SIGN` on the private key and `CKA_VERIFY` on the public key.

<Warning>
  Always pass `-sign` when you generate a CA key. Without a usage option, `hwsetup` requests sign, decrypt, and unwrap usage together on one key pair. Keep the key nonexportable: do not pass `-extractable`.
</Warning>

<Note>
  If a key with the same ID already exists, `hwsetup` does not replace it. The `-force` option replaces an existing key with the same ID. Do not use `-force` against a key that already backs a CA, because the CA can no longer sign with a replaced key.
</Note>

## List the keys on CryptoHub

List the key objects and their attributes to confirm the new key pair:

```shell expandable lines wrap title="Command Prompt" theme={null}
hwsetup.bat -libname "C:\Program Files\Futurex\fxpkcs11\fxpkcs11.dll" -slot 0 -pin "YOUR_PIN" -list
```

<Check>
  The output lists the key ID with a private RSA key that permits `CKA_SIGN` and a public RSA key that permits `CKA_VERIFY`, with the key length and label you set:

  ```text expandable lines wrap title="Output" theme={null}
  ID: nexus-ca-rsa
    Private RSA Key
      Operations: CKA_SIGN
    Public RSA Key
      Key length: 4096 bits
      Label: Nexus-RSA-Futurex
      Operations: CKA_VERIFY
  ```
</Check>

## Confirm the key in CryptoHub

<Steps>
  <Step>
    Log in to the CryptoHub and go to **Key Management**.
  </Step>

  <Step>
    Select the key group for the service you deployed. Its name is the service name followed by `-Asym`, for example `Nexus PKI-Asym`.
  </Step>

  <Step>
    Find the key in the **Keys** list.

    <Check>
      The **Name** column starts with the label you set, followed by the key ID and a numeric suffix, for example `Nexus-RSA-Futurex_nexus-ca-rsa_<number>`. The **Algorithm** column shows `RSA-4096`.
    </Check>
  </Step>
</Steps>

Record the key ID. You select it in Certificate Manager in the next step.