Skip to main content
Generate the CA signing key on the CryptoHub before you configure step-ca. This key signs every certificate the CA issues, and it is generated on the appliance as a non-extractable token object, so no private key material reaches the host.

​
Key requirements

Record both the label and the key ID. Every step-ca and step-kms-plugin command in this guide addresses the key by a PKCS #11 URI that carries both values: pkcs11:id=7101;object=smallstep-ca-key. A URI with only object= is incomplete and the operation fails to find the key.
The key ID 7101 is arbitrary. You may choose a different hexadecimal ID, but you must then use your value consistently in the key generation command, the intermediate certificate command, and both places ca.json references the key.

​
Option 1: Generate the key with PKCS11Manager

PKCS11Manager ships in the endpoint ZIP and generates the key through an interactive menu.
1
Launch the utility from the FXPKCS11 directory:
Shell
2
Log in with the PKCS #11 PIN when prompted.
3
Create an RSA key pair with the settings in the key requirements table above. Set the label to smallstep-ca-key, the ID to 7101, the key type to RSA, and the size to 3072, with sign and verify usage.

​
Option 2: Generate the key with pkcs11-tool

pkcs11-tool generates the same key non-interactively, which suits a scripted deployment.
1
Run the key generation command against the FXPKCS11 module:
Shell
2
Enter the PKCS #11 PIN when prompted.
pkcs11-tool accepts --pin to supply the PIN as an argument, but a PIN passed on the command line is visible in your shell history and in the system process list. Let the tool prompt instead.
step kms create is not a usable key generation path for this integration. On FXPKCS11 5.23 it returns CKR_TEMPLATE_INCONSISTENT because the key template the step-kms-plugin sets is rejected by the module. Use PKCS11Manager or pkcs11-tool as shown above.

​
Verify the key

Confirm the key exists on the appliance and that both the private and public objects carry the label you set.
Shell
The response lists a private key object and a public key object with the label smallstep-ca-key:
Shell
If the command lists no objects, confirm you logged in and that configTest still succeeds. A successful configTest with an empty object list means the key generation step did not complete.