> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a CA signing key

> Step-by-step guide to generate the step-ca intermediate CA signing key on the CryptoHub through Futurex PKCS

Generate the CA signing key on the CryptoHub before you configure step-ca. This key signs every certificate the CA issues, and it is generated on the appliance as a non-extractable token object, so no private key material reaches the host.

## Key requirements

| Setting    | Value              |
| ---------- | ------------------ |
| Label      | `smallstep-ca-key` |
| Key ID     | `7101`             |
| Key type   | RSA                |
| Key size   | 3072               |
| Usage      | Sign and verify    |
| Exportable | No                 |
| Persistent | Yes                |

<Warning>
  Record both the **label** and the **key ID**. Every step-ca and step-kms-plugin command in this guide addresses the key by a PKCS #11 URI that carries both values: `pkcs11:id=7101;object=smallstep-ca-key`. A URI with only `object=` is incomplete and the operation fails to find the key.
</Warning>

<Note>
  The key ID `7101` is arbitrary. You may choose a different hexadecimal ID, but you must then use your value consistently in the key generation command, the intermediate certificate command, and both places `ca.json` references the key.
</Note>

## Option 1: Generate the key with PKCS11Manager

`PKCS11Manager` ships in the endpoint ZIP and generates the key through an interactive menu.

<Steps>
  <Step>
    Launch the utility from the FXPKCS11 directory:

    ```shell expandable lines wrap title="Shell" theme={null}
    cd /usr/local/lib/fxpkcs11
    sudo ./PKCS11Manager
    ```
  </Step>

  <Step>
    Log in with the PKCS #11 PIN when prompted.
  </Step>

  <Step>
    Create an RSA key pair with the settings in the key requirements table above. Set the label to `smallstep-ca-key`, the ID to `7101`, the key type to RSA, and the size to 3072, with sign and verify usage.
  </Step>
</Steps>

## Option 2: Generate the key with pkcs11-tool

`pkcs11-tool` generates the same key non-interactively, which suits a scripted deployment.

<Steps>
  <Step>
    Run the key generation command against the FXPKCS11 module:

    ```shell expandable lines wrap title="Shell" theme={null}
    pkcs11-tool --module /usr/local/lib/fxpkcs11/libfxpkcs11.so --login --keypairgen --key-type rsa:3072 --label smallstep-ca-key --id 7101 --usage-sign
    ```
  </Step>

  <Step>
    Enter the PKCS #11 PIN when prompted.

    <Note>
      `pkcs11-tool` accepts `--pin` to supply the PIN as an argument, but a PIN passed on the command line is visible in your shell history and in the system process list. Let the tool prompt instead.
    </Note>
  </Step>
</Steps>

<Note>
  `step kms create` is not a usable key generation path for this integration. On FXPKCS11 `5.23` it returns `CKR_TEMPLATE_INCONSISTENT` because the key template the step-kms-plugin sets is rejected by the module. Use `PKCS11Manager` or `pkcs11-tool` as shown above.
</Note>

## Verify the key

Confirm the key exists on the appliance and that both the private and public objects carry the label you set.

```shell expandable lines wrap title="Shell" theme={null}
pkcs11-tool --module /usr/local/lib/fxpkcs11/libfxpkcs11.so --slot 0 --login --list-objects
```

<Check>
  The response lists a private key object and a public key object with the label `smallstep-ca-key`:

  ```shell expandable lines wrap title="Shell" theme={null}
  Private Key Object; RSA
    label:      smallstep-ca-key
  Public Key Object; RSA 3072 bits
    label:      smallstep-ca-key
  ```
</Check>

If the command lists no objects, confirm you logged in and that `configTest` still succeeds. A successful `configTest` with an empty object list means the key generation step did not complete.