Skip to main content
The official step-ca packages and release binaries are compiled without PKCS #11 support. A step-ca installed from the .deb package fails as follows when it reads a pkcs11 key management system block:
Shell
The long-running CA in this guide therefore runs from the smallstep/step-ca:hsm container image, which is PKCS #11 capable. You still install the step-ca package on the host so the toolchain is complete, but the container is what serves certificates.
Verify your environment meets these requirements.

​
Supported hardware

  • CryptoHub, 7.0.3.x or later.

​
Supported operating systems

  • Linux
The validated platform for this guide is Ubuntu 24.04.4 LTS on x86_64 with OpenSSL 3.0.13.
This guide is Linux only. The smallstep/step-ca:hsm image is a Linux container and cannot load the Windows FXPKCS11 library, so no Windows path is documented for the long-running CA.

​
Required access

  • An account on the CryptoHub with administrator permissions to deploy new services.
  • Local administrator/root access on the computer where step-ca runs.

​
Network and firewall

  • Allow outbound TCP port 2001 (default Host API port) from the computer running step-ca to the CryptoHub, specified by FQDN (for example, cryptohub.example.com) or CIDR (for example, 10.0.0.0/24).
  • Allow inbound HTTPS on TCP port 9000 from the clients that request certificates to the step-ca host.
  • Ensure DNS resolution is available for the CryptoHub address and for the DNS names you configure on the CA.
TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.

​
Required software

  • Docker, to run the smallstep/step-ca:hsm image.
  • The step CLI (step).
  • The step-kms-plugin (step kms).
  • The step-ca package, for the host toolchain.
  • The Futurex PKCS #11 (FXPKCS11) module, delivered in the CryptoHub endpoint ZIP.
  • OpenSSL, for independent signature and certificate chain verification.
  • pkcs11-tool, available in the opensc package.

​
Validated toolchain

The following versions were validated end to end for this guide. Later releases in the same series are expected to work, but these are the versions the documented commands and output were confirmed against.
The download commands in Install step-ca and the step CLI fetch the current Smallstep releases, and smallstep/step-ca:hsm is a moving tag rather than a pinned version. Expect versions later than the table above. If a command in this guide behaves differently, compare your installed versions against this table first.