Skip to main content
Prove the integration end to end: request a TLS server certificate in Smart ID Self-Service, approve it in Identity Manager, and confirm that the CA backed by CryptoHub signed it. The menu names below are from the Smart ID Self-Service and Identity Manager portals of a typical Smart ID deployment. Your request tiles and approval queues depend on how your Smart ID administrator configured them.

​
Before you begin

Prepare a CSR for a test server, for example with OpenSSL:
Shell

​
Register a server

1
Log in to Smart ID Self-Service.
2
On the Dashboard, select Register Server for SSL/TLS Certificate.
3
Enter the server details: Server DNS, Server Model, Server Serial Number, Server Administrator Email, and Purpose of Device. Select [ Submit ].
Self-Service reports that the process completed successfully, and the server appears under Servers > My Devices.

​
Request a certificate

1
Open the server you registered, select Possible actions, and select the action to request an SSL certificate.
2
On Upload CSR, upload the CSR file, enter a Justification, and select [ Next ].
3
On Review CSR, confirm the subject details and select [ Submit ].
Under Requests > My Certificate Requests, the request shows the status Awaiting Approval.

​
Approve the request

1
Log in to Identity Manager as an approver.
2
In the pending certificate request approval search, find the request for your server and open it.
3
On Review Request, review the CSR details, enter Approver Comments, and select [ Approve ].
Back in Smart ID Self-Service, Requests > My Certificate Requests shows the request with the status Completed, and the certificate appears under Certificates > SSL Certificates with the status Issued.
When Certificate Manager issued this certificate, it sent the signing operation to CryptoHub through FXPKCS11.

​
Confirm the certificate chain

1
Open the completed request in My Certificate Requests and download the certificate.
2
Import your root CA certificate, and the subordinate CA certificate if you created one, into the Windows certificate store, so Windows can build the chain.
3
Open the downloaded certificate and select the Certification Path tab.
The path runs from your root CA, through the CA backed by CryptoHub, to the server certificate, and Certificate status reads This certificate is OK.
You can also verify the chain independently with OpenSSL:
Shell
The response is:
Output
Replace root-ca.pem, nexus-ca.pem, and test-server.cer with your root CA certificate, the certificate of the CA backed by CryptoHub, and the downloaded server certificate, all in PEM format.

​
Confirm the CryptoHub key signed the certificate

1
On the Details tab of the CA certificate backed by CryptoHub, note the Subject and the key size of the Public key.
2
In CryptoHub, go to Key Management and select the key group for the service you deployed, for example Nexus PKI-Asym.
3
Find the key whose name starts with the label you set with hwsetup.
The key’s algorithm and size match the CA certificate’s public key, for example RSA-4096.
Together, these checks close the loop. Self-Service issued a certificate after approval, the certificate chains to your root through the CA backed by CryptoHub, and that CA’s key lives in the service key group on CryptoHub. The integration is validated.