> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a key pair and certificate on the Vectera Plus

> Step-by-step guide using FXCLI to generate key pair, CSR, CA, and sign certificate on Vectera Plus.

This section shows how to use FXCLI to perform the following tasks:

1. Log in to the HSM.
2. Create a new key pair on the Vectera Plus.
3. Generate a CSR from that key pair.
4. Create a CA
5. Sign the CSR by using a CA that you also create on the HSM.

## Log in to the HSM

Perform the following steps to connect and log in to the HSM through FXCLI:

<Steps>
  <Step>
    Run the FXCLI application.
  </Step>

  <Step>
    Configure TLS certificates for communication between FXCLI and the HSM by using the `tls` set of commands.

    <Note>
      Run `tls help` to access syntax documentation.
    </Note>
  </Step>

  <Step>
    Connect to the HSM by using the following command:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      connect tcp --connect hsm_ip:9009
    ```
  </Step>

  <Step>
    Log in to the HSM with the default **Admin1** and **Admin2** identities by running the following command twice (entering the username and password when prompted):

    ```shell title="FXCLI" expandable lines wrap theme={null}
      login user
    ```
  </Step>
</Steps>

## Create a key pair

Perform the following steps to create a new key pair on the Vectera Plus:

<Steps>
  <Step>
    Create a new key pair in the next available key slot on the HSM, modifying the key usage values to match your specific requirements:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      generate --algo RSA --bits 2048 --name IgDemoKeyPair --usage sign,verify --slot next
    ```
  </Step>

  <Step>
    Confirm which key slot the private key was added to:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      keytable list
    ```
  </Step>

  <Step>
    Assign a **PKCS11** label to the key (**certutil** needs you to set this external data field so that it can find the key in a later section):

    <Note>
      The PKCS11 label value should match the name that was set for the key pair in the generate command.
    </Note>

    ```shell title="FXCLI" expandable lines wrap theme={null}
       keytable extdata --slot 0 --p11-attr label --p11-value IgDemoKeyPair
    ```
  </Step>
</Steps>

## Generate a CSR

Perform the following steps to generate a CSR:

<Steps>
  <Step>
    Generate a CSR from the new key pair that was created:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      x509 req --private-slot IgDemoKeyPair --out IgDemo.csr
    ```
  </Step>
</Steps>

## Create a Certificate Authority

Perform the following steps to create a Certificate Authority:

<Steps>
  <Step>
    Create a new key pair in the next available key slot on the HSM:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      generate --algo RSA --bits 2048 --usage mak --name CaKeyPair --slot next
    ```
  </Step>

  <Step>
    Create a certificate from the new key pair that you created:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      x509 sign --private-slot CaKeyPair --key-usage DigitalSignature --key-usage KeyCertSign --ca true --pathlen 0 --dn 'O=Futurex\CN=Root' --out Ca.pem
    ```

    <Note>
      Note that the CA certificate was output to a file called `Ca.pem`.
    </Note>
  </Step>

  <Step>
    Confirm which key slot the private key was added to:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      keytable list
    ```
  </Step>

  <Step>
    Assign a **PKCS11** label to the key (**certutil** needs you to set this external data field so that it can find the key in a later section):

    <Note>
      The PKCS11 label value should match the name that was set for the key pair in the generate command.
    </Note>

    ```shell title="FXCLI" expandable lines wrap theme={null}
      keytable extdata --slot 1 --p11-attr label --p11-value CaKeyPair
    ```
  </Step>
</Steps>

## Sign the CSR

Perform the following steps to sign the CSR by using the Certificate Authority:

<Steps>
  <Step>
    Sign the CSR with the CA you just created, modifying the key usage values to match your specific certificate requirements:

    ```shell title="FXCLI" expandable lines wrap theme={null}
      x509 sign --csr IgDemo.csr --issuer Ca.pem --private-slot CaKeyPair --ca false --key-usage DigitalSignature --key-usage KeyEncipherment --key-usage DataEncipherment --key-usage KeyAgreement --eku Client --dn 'O=Futurex\CN=IG-Demo' --out IgDemo.pem
    ```

    <Note>
      Note that the signed leaf certificate was output to a file called `IgDemo.pem`.
    </Note>
  </Step>
</Steps>