> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a key pair and certificate on the CryptoHub

> Step-by-step guide to generate a key pair and TLS certificate on the CryptoHub with keytool for Java keystore use.

This section uses Java **keytool** to generate an RSA 2048 key pair and a self-signed TLS server certificate on the CryptoHub for Curity Identity Server. On **FXPKCS11 6.0 rev dc27 or later**, this single command generates the key pair on the appliance and produces a usable `PrivateKeyEntry` in the Java keystore, with no CryptoHub UI step.

The private key stays on the CryptoHub. Curity references the resulting keystore entry through the SunPKCS11 provider to serve TLS.

<Note>
  The `keytool` application is included in the JDK installation, so you can run the `keytool` commands in this section with no additional configuration.
</Note>

## Generate the key pair and certificate

Perform the following steps to generate the TLS server certificate and key pair on the CryptoHub:

<Steps>
  <Step>
    Export **FXPKCS11\_CFG** so the Futurex PKCS #11 library can locate its configuration file (`fxpkcs11.cfg`). Point it at the `fxpkcs11.cfg` you configured in [Install and configure Futurex PKCS #11](/Integrations/CryptoHub/Privileged_access_management/Curity_Identity_Server/Install_and_configure_Futurex_PKCS_11):

    ```shell expandable lines wrap title="Shell" theme={null}
    export FXPKCS11_CFG=/etc/fxpkcs11.cfg
    ```

    <Note>
      This step relies on the corrected SunPKCS11 configuration file (`pkcs11.cfg`) created in [Configure SunPKCS11 to use the Futurex PKCS #11 module](/Integrations/CryptoHub/Privileged_access_management/Curity_Identity_Server/Configure_SunPKCS11_to_use_the_Futurex_PKCS_11_module). Passing `pkcs11.cfg` on the command line (with `-providerArg`) is not enough on its own; without `FXPKCS11_CFG`, the token does not appear.
    </Note>
  </Step>

  <Step>
    Execute the following command, passing the `pkcs11.cfg` file you created in the previous section with `-providerArg`. This generates an RSA 2048 key pair and self-signs a TLS server certificate with the common name `Demo_1`:

    ```text expandable lines wrap title="Text" theme={null}
    keytool -genkeypair -alias Demo_1 -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -dname "CN=Demo_1, O=Futurex" -validity 365 -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /usr/local/etc/pkcs11.cfg -providerName SunPKCS11-Futurex
    ```

    <Check>
      The keytool application generates the key pair on the CryptoHub and self-signs a certificate for it. With no `-storepass` on the command line, keytool prompts for the keystore password.
    </Check>
  </Step>

  <Step>
    When prompted for the keystore password, enter the CryptoHub identity password (PKCS #11 PIN) configured inside the `<CRYPTO-OPR-PASS>` tag in the `fxpkcs11.cfg` file.
  </Step>
</Steps>

## Verify the private key entry linked to the TLS server certificate is in the Java keystore

Run the following **keytool** command to confirm that the key pair was generated on the CryptoHub and that the keystore lists a `PrivateKeyEntry`. The `-providerArg` flag passes the `pkcs11.cfg` file you created in the previous section:

```shell expandable lines wrap title="Shell" theme={null}
keytool -list -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /usr/local/etc/pkcs11.cfg -providerName SunPKCS11-Futurex
```

When prompted for the keystore password, enter the identity password configured inside the `<CRYPTO-OPR-PASS>` tag in the `fxpkcs11.cfg` file.

<Check>
  If the command succeeds, you see an output similar to the following:

  ```none expandable lines wrap title="None" theme={null}
  Keystore type: PKCS11
  Keystore provider: SunPKCS11-Futurex

  Your keystore contains 1 entry

  Demo_1-1784141140:Demo_1, PrivateKeyEntry,
  Certificate fingerprint (SHA-256): 00:7B:83:00:AE:6A:CF:64:FA:C0:3F:B4:40:55:E2:9C:12:26:43:C7:D4:92:4E:DA:20:E2:E5:96:4B:48:1F:D3
  ```
</Check>

<Warning>
  The CryptoHub assigns the on-token key its own alias in the form `<alias>-<id>:<alias>` (for example, `Demo_1-1784141140:Demo_1`), where `<id>` is generated per key and is not deterministic. This mangled alias, not the short `-alias` value (`Demo_1`) you passed to `keytool -genkeypair`, is the keystore entry name that Curity must reference. Copy the exact alias from this `keytool -list` output and enter it in Curity's key **Name** field in [Configure Curity to use the CryptoHub for TLS](/Integrations/CryptoHub/Privileged_access_management/Curity_Identity_Server/Configure_Curity_to_use_the_CryptoHub_for_TLS).

  The certificate common name is unaffected: it comes from `-dname`, so the CN remains `Demo_1`, which the [Validate and test](/Integrations/CryptoHub/Privileged_access_management/Curity_Identity_Server/Validate_and_test) page checks.
</Warning>