Skip to main content
Integrate with AppViewX to generate certificate keys inside CryptoHub while AppViewX manages certificate enrollment against your certificate authority. AppViewX is a certificate lifecycle management platform that discovers, enrolls, renews, and revokes certificates across an enterprise estate. In this integration, AppViewX keeps its role as the lifecycle manager and system of record, and CryptoHub becomes the key store: every private key is generated inside the HSM and never leaves it.

​
Key features

This integration has the following features:
  • HSM-resident key generation: AppViewX requests an RSA key pair from CryptoHub. The private key is generated in the HSM and is never exported to AppViewX or to disk.
  • In-HSM certificate signing requests: CryptoHub generates the PKCS #10 certificate signing request (CSR) and signs it with the resident private key, so proof of possession never requires access to key material.
  • External CA enrollment: AppViewX submits the CSR to your certificate authority, so you keep your existing issuance policy, templates, and approval workflow.
  • Centralized inventory: The issued certificate is recorded in the AppViewX inventory alongside the rest of your estate, while the key stays under CryptoHub custody.
  • No client library on the AppViewX host: The integration runs over HTTPS against the CryptoHub REST API, so it requires no PKCS #11, CNG, or KMIP client installation.

​
Benefits of CryptoHub integration through the REST API

Integrating with CryptoHub provides the following benefits:
  • Enhanced security: Private keys are generated and retained in FIPS-validated hardware, which removes the risk of key exposure in the certificate management tier.
  • Separation of duties: Certificate lifecycle automation stays in AppViewX while key custody and cryptographic policy stay in CryptoHub, each with its own access control.
  • Compliance advantage: HSM-resident key generation supports regulatory requirements for key protection, such as those in FIPS and PCI DSS.
  • Centralized key management: CryptoHub holds keys for this and other integrations in one place, which simplifies auditing and key inventory.
  • Operational resilience: CryptoHub clustering and failover keep key operations available to the certificate lifecycle workflow.

​
How the integration works

AppViewX drives the workflow. CryptoHub performs the key and CSR operations, and the certificate authority issues the certificate.

The AppViewX and CryptoHub certificate enrollment workflow, from request submission to certificate storage. The private key is generated in the HSM and never leaves CryptoHub.

  1. AppViewX authenticates to the CryptoHub REST API as the service endpoint identity and receives a JSON Web Token (JWT) for the session.
  2. AppViewX requests an RSA key pair. CryptoHub generates it in the HSM, stores it in the target key group, and retains the private key.
  3. AppViewX requests a CSR. CryptoHub builds a PKCS #10 request for the subject you supply and signs it with the resident private key, returning the request as hex-encoded DER.
  4. AppViewX decodes the request and submits it to the selected certificate authority, adding any subject alternative names (SANs) at submission time.
  5. The certificate authority issues the certificate. AppViewX records it in its inventory. The private key remains in CryptoHub.
CryptoHub does not carry SANs in the CSR generation command. AppViewX supplies SAN values to the certificate authority when it submits the request, so the issued certificate contains them even though the CSR does not. Confirm that your certificate authority accepts SANs from the request submission rather than only from the CSR.
Optionally, you can import the issued certificate back into CryptoHub so it is held in an X.509 certificate container linked to its resident private key. See Submit the CSR to a certificate authority.

​
Architecture

You deploy the integration as a CryptoHub service from the AppViewX template, then create an endpoint that provisions the identity AppViewX authenticates as. AppViewX reaches CryptoHub over the REST API. Two endpoints carry the integration: the login endpoint for authentication, and the Excrypt protocol bridge for the key and CSR operations. For details on the bridge, see Excrypt protocol bridge.

​
Scope of this guide

This guide covers certificate creation with RSA keys, where AppViewX generates the key pair and CSR in CryptoHub and submits the request to an external certificate authority. The following are outside its scope:
  • Certificate renewal. AppViewX handles renewal through its own flow, reusing the stored CSR while the private key remains in CryptoHub.
  • ECC keys. The documented procedure uses RSA. CryptoHub supports ECC key generation, but this integration path is documented for RSA only.
  • Certificate authority configuration. For guidance on preparing Microsoft Active Directory Certificate Services, see Microsoft ADCS.