Validate the integration - Futurex Documentation

Prove the integration end to end: the CA answers, it issues a certificate, that certificate chains to your root, and its issuer is the HSM-backed intermediate. Run these commands on the CA host. step ca init wrote the root certificate into ~/.step there, so the step CLI already trusts the CA and the commands below use localhost.

Validating from a different machine is outside the scope of this guide. A remote client must first be given the CA root certificate and be configured to trust it. Refer to the Smallstep step-ca documentation for client bootstrap once this on-host validation passes.

Verify CA health

Shell

step ca health --ca-url https://localhost:9000

The response is:

Shell

ok

Generate a one-time token

The JWK provisioner that step ca init created is unlocked by the CA password. Use the same password file, which the provisioner flag reads directly.

Shell

TOKEN=$(step ca token test.local --ca-url https://localhost:9000 --provisioner admin@localhost --provisioner-password-file /tmp/ca-password.txt)

--provisioner-password-file takes the password you set with --password-file during step ca init, because that one password encrypted the provisioner key as well as the root key. Use the provisioner name you chose during step ca init; this guide uses admin@localhost.

The command sets $TOKEN and prints nothing. Confirm the variable is populated:

Shell

echo "${TOKEN:0:20}"

Issue a certificate

Shell

step ca certificate --token "$TOKEN" --ca-url https://localhost:9000 test.local test.crt test.key

The response reports both files:

Shell

✔ Certificate: test.crt
✔ Private Key: test.key

This request is what drives the appliance: the CA signed test.crt with the CryptoHub-resident key at this moment.

Confirm the issuer

Shell

step certificate inspect test.crt --short

The Issuer field is the HSM-backed intermediate CA:

Shell

X.509v3 TLS Certificate (ECDSA P-256) [Serial: ...]
  Subject:     test.local
  Issuer:      CryptoHub Smallstep Intermediate CA
  Provisioner: admin@localhost [ID: ...]

Issuer: CryptoHub Smallstep Intermediate CA confirms the certificate was signed by the intermediate whose private key lives in the CryptoHub, not by the software intermediate that step ca init created.

Verify the certificate chain

Validate the chain independently with OpenSSL, which knows nothing about step-ca or PKCS #11.

Shell

openssl verify -CAfile ~/.step/certs/root_ca.crt -untrusted ~/.step/certs/intermediate_ca.crt test.crt

The response is:

Shell

test.crt: OK

Confirm the appliance signed at issuance

The FXPKCS11 log inside the container records the Host API session that carried the signature. Its timestamps line up with the moment you ran step ca certificate.

Shell

sudo docker exec stepca tail -40 /tmp/fxpkcs11.log

The log shows a session opening to your CryptoHub on port 2001 and logging in, timestamped at the issuance you performed above:

Shell

C_OpenSession: Called with slot #0.
setupSSL: Setting up SSL. (Session 1)
openConnection: Established connection to HSM at Futurex.(Session 1)
C_FX_LoginWithUser: Called with session #1

Together, these checks close the loop. The CA is healthy, it issued a certificate that chains to your root, the issuer is the intermediate backed by CryptoHub, and the FXPKCS11 log proves the signature was produced on the appliance at issuance time. The integration is validated.

​Verify CA health

​Generate a one-time token

​Issue a certificate

​Confirm the issuer

​Verify the certificate chain

​Confirm the appliance signed at issuance

Verify CA health

Generate a one-time token

Issue a certificate

Confirm the issuer

Verify the certificate chain

Confirm the appliance signed at issuance