> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate the integration

> Request, approve, and download a TLS server certificate in Nexus Smart ID, then confirm the CryptoHub-resident CA key signed it.

Prove the integration end to end: request a TLS server certificate in Smart ID Self-Service, approve it in Identity Manager, and confirm that the CA backed by CryptoHub signed it.

The menu names below are from the Smart ID Self-Service and Identity Manager portals of a typical Smart ID deployment. Your request tiles and approval queues depend on how your Smart ID administrator configured them.

## Before you begin

Prepare a CSR for a test server, for example with OpenSSL:

```shell expandable lines wrap title="Shell" theme={null}
openssl req -new -newkey rsa:2048 -nodes -keyout test-server.key -out test-server.csr -subj "/CN=test-server.example.com"
```

## Register a server

<Steps>
  <Step>
    Log in to Smart ID Self-Service.
  </Step>

  <Step>
    On the **Dashboard**, select **Register Server for SSL/TLS Certificate**.
  </Step>

  <Step>
    Enter the server details: **Server DNS**, **Server Model**, **Server Serial Number**, **Server Administrator Email**, and **Purpose of Device**. Select **\[ Submit ]**.

    <Check>
      Self-Service reports that the process completed successfully, and the server appears under **Servers** > **My Devices**.
    </Check>
  </Step>
</Steps>

## Request a certificate

<Steps>
  <Step>
    Open the server you registered, select **Possible actions**, and select the action to request an SSL certificate.
  </Step>

  <Step>
    On **Upload CSR**, upload the CSR file, enter a **Justification**, and select **\[ Next ]**.
  </Step>

  <Step>
    On **Review CSR**, confirm the subject details and select **\[ Submit ]**.

    <Check>
      Under **Requests** > **My Certificate Requests**, the request shows the status **Awaiting Approval**.
    </Check>
  </Step>
</Steps>

## Approve the request

<Steps>
  <Step>
    Log in to Identity Manager as an approver.
  </Step>

  <Step>
    In the pending certificate request approval search, find the request for your server and open it.
  </Step>

  <Step>
    On **Review Request**, review the CSR details, enter **Approver Comments**, and select **\[ Approve ]**.
  </Step>
</Steps>

<Check>
  Back in Smart ID Self-Service, **Requests** > **My Certificate Requests** shows the request with the status **Completed**, and the certificate appears under **Certificates** > **SSL Certificates** with the status **Issued**.
</Check>

When Certificate Manager issued this certificate, it sent the signing operation to CryptoHub through FXPKCS11.

## Confirm the certificate chain

<Steps>
  <Step>
    Open the completed request in **My Certificate Requests** and download the certificate.
  </Step>

  <Step>
    Import your root CA certificate, and the subordinate CA certificate if you created one, into the Windows certificate store, so Windows can build the chain.
  </Step>

  <Step>
    Open the downloaded certificate and select the **Certification Path** tab.

    <Check>
      The path runs from your root CA, through the CA backed by CryptoHub, to the server certificate, and **Certificate status** reads **This certificate is OK.**
    </Check>
  </Step>
</Steps>

You can also verify the chain independently with OpenSSL:

```shell expandable lines wrap title="Shell" theme={null}
openssl verify -CAfile root-ca.pem -untrusted nexus-ca.pem test-server.cer
```

<Check>
  The response is:

  ```text expandable lines wrap title="Output" theme={null}
  test-server.cer: OK
  ```
</Check>

Replace `root-ca.pem`, `nexus-ca.pem`, and `test-server.cer` with your root CA certificate, the certificate of the CA backed by CryptoHub, and the downloaded server certificate, all in PEM format.

## Confirm the CryptoHub key signed the certificate

<Steps>
  <Step>
    On the **Details** tab of the CA certificate backed by CryptoHub, note the **Subject** and the key size of the **Public key**.
  </Step>

  <Step>
    In CryptoHub, go to **Key Management** and select the key group for the service you deployed, for example `Nexus PKI-Asym`.
  </Step>

  <Step>
    Find the key whose name starts with the label you set with `hwsetup`.

    <Check>
      The key's algorithm and size match the CA certificate's public key, for example `RSA-4096`.
    </Check>
  </Step>
</Steps>

Together, these checks close the loop. Self-Service issued a certificate after approval, the certificate chains to your root through the CA backed by CryptoHub, and that CA's key lives in the service key group on CryptoHub. The integration is validated.