Skip to main content
This guide configures a Microsoft Active Directory Certificate Services (AD CS) subordinate certificate authority that uses an ML-DSA private key protected by CryptoHub. A CryptoHub-hosted ML-DSA root CA signs the subordinate CA certificate.

​
What you’ll build

  • An ML-DSA root CA whose private key remains protected by CryptoHub.
  • An ML-DSA subordinate CA whose private key AD CS accesses through the Futurex CryptoHub Key Storage Provider.
  • An X.509 CA chain in which the CryptoHub root signs the AD CS subordinate certificate.
  • A test certificate issued by AD CS to prove that the subordinate CA can sign through CryptoHub.

​
The CA key model

The root CA and subordinate CA serve different roles:
  • CryptoHub ML-DSA root CA: CryptoHub creates and protects the root private key. Use this CA to sign the AD CS subordinate request.
  • AD CS ML-DSA subordinate CA: AD CS creates the subordinate key through the CryptoHub CNG provider. CryptoHub performs private-key operations; Windows retains the subordinate certificate and its CNG key reference.
  • Issued certificates: AD CS creates and issues certificates while the subordinate CA signing operation runs through the CNG provider on CryptoHub.
The root and subordinate private keys do not need to move to the Windows Server. The certificate request and signed public certificates move between AD CS and CryptoHub.

​
How it works

  1. Create an ML-DSA root CA in CryptoHub.
  2. Deploy the Microsoft ADCS service and download a client endpoint bundle.
  3. Install cryptohub-cng.dll as the Futurex CryptoHub Key Storage Provider on the AD CS server.
  4. Configure AD CS as a subordinate CA and create its ML-DSA key through the provider.
  5. Submit the subordinate certificate signing request to the CryptoHub root CA.
  6. Install the signed subordinate certificate in AD CS.
  7. Issue a certificate and confirm that AD CS signs it with the CryptoHub-backed subordinate key.
The CryptoHub Client Library connects to CryptoHub through the REST API over TLS on TCP port 443.

​
Why this integration uses CNG

AD CS uses the Windows Cryptography API: Next Generation key-storage interface. Registering the Futurex CNG Key Storage Provider lets AD CS create and use a CryptoHub-backed CA key through the native Windows interface. This workflow does not use the legacy Futurex FXCL KMES CNG provider which connects to the Host API over port 2001.

​
Integration workflow

  1. Review the prerequisites.
  2. Prepare CryptoHub.
  3. Install and configure CryptoHub CNG.
  4. Configure the ML-DSA subordinate CA.
  5. Verify the integration.
  6. Troubleshoot the integration.
For the complete CNG provider reference, see CryptoHub CNG developer guide.