> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate the integration

> Issue a leaf certificate from the running CA and verify its chain to prove the CryptoHub-resident key signed it.

Prove the integration end to end: the CA answers, it issues a certificate, that certificate chains to your root, and its issuer is the HSM-backed intermediate.

Run these commands on the CA host. `step ca init` wrote the root certificate into `~/.step` there, so the step CLI already trusts the CA and the commands below use `localhost`.

<Note>
  Validating from a different machine is outside the scope of this guide. A remote client must first be given the CA root certificate and be configured to trust it. Refer to the Smallstep step-ca documentation for client bootstrap once this on-host validation passes.
</Note>

## Verify CA health

```shell expandable lines wrap title="Shell" theme={null}
step ca health --ca-url https://localhost:9000
```

<Check>
  The response is:

  ```shell expandable lines wrap title="Shell" theme={null}
  ok
  ```
</Check>

## Generate a one-time token

The JWK provisioner that `step ca init` created is unlocked by the CA password. Use the same password file, which the provisioner flag reads directly.

```shell expandable lines wrap title="Shell" theme={null}
TOKEN=$(step ca token test.local --ca-url https://localhost:9000 --provisioner admin@localhost --provisioner-password-file /tmp/ca-password.txt)
```

<Note>
  `--provisioner-password-file` takes the password you set with `--password-file` during `step ca init`, because that one password encrypted the provisioner key as well as the root key. Use the provisioner name you chose during `step ca init`; this guide uses `admin@localhost`.
</Note>

<Check>
  The command sets `$TOKEN` and prints nothing. Confirm the variable is populated:

  ```shell expandable lines wrap title="Shell" theme={null}
  echo "${TOKEN:0:20}"
  ```
</Check>

## Issue a certificate

```shell expandable lines wrap title="Shell" theme={null}
step ca certificate --token "$TOKEN" --ca-url https://localhost:9000 test.local test.crt test.key
```

<Check>
  The response reports both files:

  ```shell expandable lines wrap title="Shell" theme={null}
  ✔ Certificate: test.crt
  ✔ Private Key: test.key
  ```
</Check>

This request is what drives the appliance: the CA signed `test.crt` with the CryptoHub-resident key at this moment.

## Confirm the issuer

```shell expandable lines wrap title="Shell" theme={null}
step certificate inspect test.crt --short
```

<Check>
  The `Issuer` field is the HSM-backed intermediate CA:

  ```shell expandable lines wrap title="Shell" theme={null}
  X.509v3 TLS Certificate (ECDSA P-256) [Serial: ...]
    Subject:     test.local
    Issuer:      CryptoHub Smallstep Intermediate CA
    Provisioner: admin@localhost [ID: ...]
  ```
</Check>

`Issuer: CryptoHub Smallstep Intermediate CA` confirms the certificate was signed by the intermediate whose private key lives in the CryptoHub, not by the software intermediate that `step ca init` created.

## Verify the certificate chain

Validate the chain independently with OpenSSL, which knows nothing about step-ca or PKCS #11.

```shell expandable lines wrap title="Shell" theme={null}
openssl verify -CAfile ~/.step/certs/root_ca.crt -untrusted ~/.step/certs/intermediate_ca.crt test.crt
```

<Check>
  The response is:

  ```shell expandable lines wrap title="Shell" theme={null}
  test.crt: OK
  ```
</Check>

## Confirm the appliance signed at issuance

The FXPKCS11 log inside the container records the Host API session that carried the signature. Its timestamps line up with the moment you ran `step ca certificate`.

```shell expandable lines wrap title="Shell" theme={null}
sudo docker exec stepca tail -40 /tmp/fxpkcs11.log
```

<Check>
  The log shows a session opening to your CryptoHub on port 2001 and logging in, timestamped at the issuance you performed above:

  ```shell expandable lines wrap title="Shell" theme={null}
  C_OpenSession: Called with slot #0.
  setupSSL: Setting up SSL. (Session 1)
  openConnection: Established connection to HSM at Futurex.(Session 1)
  C_FX_LoginWithUser: Called with session #1
  ```
</Check>

Together, these checks close the loop. The CA is healthy, it issued a certificate that chains to your root, the issuer is the intermediate backed by CryptoHub, and the FXPKCS11 log proves the signature was produced on the appliance at issuance time. The integration is validated.