> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate PKCS #11 connectivity

> Confirm the step toolchain reaches the CryptoHub-resident CA key through Futurex PKCS #11 before you configure the CA.

Validate the full signing path before you configure the CA. Every command on this page runs on the host, independently of step-ca, so a failure here isolates the problem to the PKCS #11 layer rather than to the CA configuration.

Confirm `FXPKCS11_CFG` is exported and `PKCS11_P12` is populated in the shell you use:

```shell expandable lines wrap title="Shell" theme={null}
echo "$FXPKCS11_CFG"
echo "$PKCS11_P12"
```

## Verify token visibility

```shell expandable lines wrap title="Shell" theme={null}
pkcs11-tool --module /usr/local/lib/fxpkcs11/libfxpkcs11.so --list-slots
```

<Check>
  The response lists one slot with the `Futurex` token:

  ```shell expandable lines wrap title="Shell" theme={null}
  Slot 0 (0x0): Futurex 0
    token label        : Futurex
    token manufacturer : Futurex
    token model        : HSM
    token flags        : login required, rng, token initialized, PIN initialized
  ```
</Check>

## Verify authentication and key visibility

```shell expandable lines wrap title="Shell" theme={null}
pkcs11-tool --module /usr/local/lib/fxpkcs11/libfxpkcs11.so --slot 0 --login --list-objects
```

<Check>
  After you enter the PKCS #11 PIN, the response lists the private and public key objects for `smallstep-ca-key`:

  ```shell expandable lines wrap title="Shell" theme={null}
  Private Key Object; RSA
    label:      smallstep-ca-key
  Public Key Object; RSA 3072 bits
    label:      smallstep-ca-key
  ```
</Check>

## Verify random number generation

This confirms the module reaches the appliance's hardware random number generator, not only its object store.

```shell expandable lines wrap title="Shell" theme={null}
pkcs11-tool --module /usr/local/lib/fxpkcs11/libfxpkcs11.so --slot 0 --generate-random 32 | xxd -p
```

<Check>
  The response is 32 bytes of hexadecimal output from the CryptoHub. The value differs on every run.
</Check>

## Verify step-kms-plugin access to the key

This is the first command that exercises the Smallstep toolchain rather than `pkcs11-tool`. Replace `<PIN>` with the PKCS #11 PIN you recorded in [Install and configure Futurex PKCS #11](/Integrations/CryptoHub/Certificate_Authority/Smallstep_step-ca/Install_and_configure_Futurex_PKCS_11).

```shell expandable lines wrap title="Shell" theme={null}
step kms key --kms 'pkcs11:module-path=/usr/local/lib/fxpkcs11/libfxpkcs11.so;token=Futurex?pin-value=<PIN>' 'pkcs11:id=7101;object=smallstep-ca-key'
```

<Check>
  The response is the public key of `smallstep-ca-key` in PEM format:

  ```shell expandable lines wrap title="Shell" theme={null}
  -----BEGIN PUBLIC KEY-----
  MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA...
  -----END PUBLIC KEY-----
  ```
</Check>

<Warning>
  The key URI requires both `id` and `object`: `pkcs11:id=7101;object=smallstep-ca-key`. A URI with `object` alone does not resolve the key on FXPKCS11 and the command fails. Use both values in every `step kms`, `step certificate`, and `ca.json` reference.
</Warning>

## Verify a signing operation

Sign a small file with the CryptoHub-resident key, then verify the signature with OpenSSL against the exported public key. The OpenSSL check is the independent proof: it confirms the signature validates against the key material, using a tool that has no knowledge of the PKCS #11 path.

<Steps>
  <Step>
    Create the input file:

    ```shell expandable lines wrap title="Shell" theme={null}
    echo -n "test" > /tmp/test.txt
    ```
  </Step>

  <Step>
    Sign it with the CryptoHub-resident key:

    ```shell expandable lines wrap title="Shell" theme={null}
    step kms sign --kms 'pkcs11:module-path=/usr/local/lib/fxpkcs11/libfxpkcs11.so;token=Futurex?pin-value=<PIN>' --in /tmp/test.txt --alg SHA256 'pkcs11:id=7101;object=smallstep-ca-key' > /tmp/test.sig
    ```

    <Note>
      step-kms-plugin `0.15.1` takes the input file through `--in` and the digest algorithm through `--alg`. It has no `--digest` flag and does not accept a precomputed digest as a positional argument.
    </Note>

    <Check>
      The command writes the signature to `/tmp/test.sig`. For an RSA-3072 key the signature is 384 bytes:

      ```shell expandable lines wrap title="Shell" theme={null}
      ls -l /tmp/test.sig
      ```
    </Check>
  </Step>

  <Step>
    Export the public key so OpenSSL has something to verify against:

    ```shell expandable lines wrap title="Shell" theme={null}
    step kms key --kms 'pkcs11:module-path=/usr/local/lib/fxpkcs11/libfxpkcs11.so;token=Futurex?pin-value=<PIN>' 'pkcs11:id=7101;object=smallstep-ca-key' > /tmp/smallstep-ca.pub
    ```
  </Step>

  <Step>
    Verify the signature with OpenSSL:

    ```shell expandable lines wrap title="Shell" theme={null}
    openssl dgst -sha256 -verify /tmp/smallstep-ca.pub -signature /tmp/test.sig /tmp/test.txt
    ```

    <Check>
      The response is:

      ```shell expandable lines wrap title="Shell" theme={null}
      Verified OK
      ```
    </Check>
  </Step>
</Steps>

<Note>
  step-kms-plugin also accepts `--verify`, which validates the signature it produced. It signals the result through its exit code, where `0` means valid, and prints no confirmation text. Because a silent success is easy to misread, this guide uses the OpenSSL check above as the visible proof.
</Note>

`Verified OK` confirms the whole chain works: the step toolchain loaded FXPKCS11, the module authenticated to the CryptoHub Host API over mutual TLS, the appliance signed with a key that never left it, and the signature validates against that key's public half. You are ready to configure the CA.