Skip to main content
Validate the full signing path before you configure the CA. Every command on this page runs on the host, independently of step-ca, so a failure here isolates the problem to the PKCS #11 layer rather than to the CA configuration. Confirm FXPKCS11_CFG is exported and PKCS11_P12 is populated in the shell you use:
Shell

​
Verify token visibility

Shell
The response lists one slot with the Futurex token:
Shell

​
Verify authentication and key visibility

Shell
After you enter the PKCS #11 PIN, the response lists the private and public key objects for smallstep-ca-key:
Shell

​
Verify random number generation

This confirms the module reaches the appliance’s hardware random number generator, not only its object store.
Shell
The response is 32 bytes of hexadecimal output from the CryptoHub. The value differs on every run.

​
Verify step-kms-plugin access to the key

This is the first command that exercises the Smallstep toolchain rather than pkcs11-tool. Replace <PIN> with the PKCS #11 PIN you recorded in Install and configure Futurex PKCS #11.
Shell
The response is the public key of smallstep-ca-key in PEM format:
Shell
The key URI requires both id and object: pkcs11:id=7101;object=smallstep-ca-key. A URI with object alone does not resolve the key on FXPKCS11 and the command fails. Use both values in every step kms, step certificate, and ca.json reference.

​
Verify a signing operation

Sign a small file with the CryptoHub-resident key, then verify the signature with OpenSSL against the exported public key. The OpenSSL check is the independent proof: it confirms the signature validates against the key material, using a tool that has no knowledge of the PKCS #11 path.
1
Create the input file:
Shell
2
Sign it with the CryptoHub-resident key:
Shell
step-kms-plugin 0.15.1 takes the input file through --in and the digest algorithm through --alg. It has no --digest flag and does not accept a precomputed digest as a positional argument.
The command writes the signature to /tmp/test.sig. For an RSA-3072 key the signature is 384 bytes:
Shell
3
Export the public key so OpenSSL has something to verify against:
Shell
4
Verify the signature with OpenSSL:
Shell
The response is:
Shell
step-kms-plugin also accepts --verify, which validates the signature it produced. It signals the result through its exit code, where 0 means valid, and prints no confirmation text. Because a silent success is easy to misread, this guide uses the OpenSSL check above as the visible proof.
Verified OK confirms the whole chain works: the step toolchain loaded FXPKCS11, the module authenticated to the CryptoHub Host API over mutual TLS, the appliance signed with a key that never left it, and the signature validates against that key’s public half. You are ready to configure the CA.