> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Checklist of environment prerequisites and requirements before integrating Smallstep step-ca with CryptoHub.

<Warning>
  The official `step-ca` packages and release binaries are compiled without PKCS #11 support. A `step-ca` installed from the `.deb` package fails as follows when it reads a `pkcs11` key management system block:

  ```shell expandable lines wrap title="Shell" theme={null}
  unsupported kms type 'pkcs11': compiled without cgo or PKCS#11 support
  ```

  The long-running CA in this guide therefore runs from the `smallstep/step-ca:hsm` container image, which is PKCS #11 capable. You still install the `step-ca` package on the host so the toolchain is complete, but the container is what serves certificates.
</Warning>

Verify your environment meets these requirements.

## Supported hardware

* CryptoHub, `7.0.3.x` or later.

## Supported operating systems

* Linux

The validated platform for this guide is Ubuntu 24.04.4 LTS on x86\_64 with OpenSSL 3.0.13.

<Note>
  This guide is Linux only. The `smallstep/step-ca:hsm` image is a Linux container and cannot load the Windows FXPKCS11 library, so no Windows path is documented for the long-running CA.
</Note>

## Required access

* An account on the CryptoHub with administrator permissions to deploy new services.
* Local administrator/root access on the computer where step-ca runs.

## Network and firewall

* Allow outbound TCP port **2001** (default Host API port) from the computer running step-ca to the CryptoHub, specified by FQDN (for example, `cryptohub.example.com`) or CIDR (for example, `10.0.0.0/24`).
* Allow inbound HTTPS on TCP port **9000** from the clients that request certificates to the step-ca host.
* Ensure DNS resolution is available for the CryptoHub address and for the DNS names you configure on the CA.

<Warning>
  TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.
</Warning>

## Required software

* Docker, to run the `smallstep/step-ca:hsm` image.
* The step CLI (`step`).
* The step-kms-plugin (`step kms`).
* The `step-ca` package, for the host toolchain.
* The Futurex PKCS #11 (FXPKCS11) module, delivered in the CryptoHub endpoint ZIP.
* OpenSSL, for independent signature and certificate chain verification.
* `pkcs11-tool`, available in the `opensc` package.

## Validated toolchain

The following versions were validated end to end for this guide. Later releases in the same series are expected to work, but these are the versions the documented commands and output were confirmed against.

| Component                         | Validated version           |
| --------------------------------- | --------------------------- |
| CryptoHub                         | `7.0.3.23b`                 |
| Futurex PKCS #11 (FXPKCS11)       | `5.23`                      |
| step CLI                          | `0.30.6`                    |
| step-kms-plugin                   | `0.15.1`                    |
| step-ca (`smallstep/step-ca:hsm`) | `0.30.2`                    |
| Docker                            | `29.1.3`                    |
| OpenSSL                           | `3.0.13`                    |
| Operating system                  | Ubuntu 24.04.4 LTS, x86\_64 |

<Note>
  The download commands in [Install step-ca and the step CLI](/Integrations/CryptoHub/Certificate_Authority/Smallstep_step-ca/Install_step-ca_and_the_step_CLI) fetch the current Smallstep releases, and `smallstep/step-ca:hsm` is a moving tag rather than a pinned version. Expect versions later than the table above. If a command in this guide behaves differently, compare your installed versions against this table first.
</Note>