# Nitrokey HSM and Certificate Export **URL:** https://support.nitrokey.com/t/nitrokey-hsm-and-certificate-export/3462 **Category:** Nitrokeys **Created:** [October 6, 2021, 5:37pm UTC](https://support.nitrokey.com/t/nitrokey-hsm-and-certificate-export/3462 "2021-10-06T17:37:01Z") **Posts on this page:** 1 **Showing post:** 2
### Author: ![saper](https://support.nitrokey.com/user_avatar/support.nitrokey.com/saper/32/493_2.png) [@saper](https://support.nitrokey.com/u/saper) #### Post date: [October 11, 2021, 11:15pm UTC](https://support.nitrokey.com/t/nitrokey-hsm-and-certificate-export/3462/2 "2021-10-11T23:15:57Z")
When Nitrokey HSM 2 (or rather Smartcard-HSM SIM Card inside of it) generates a key-pair, it just does that - no X.509 certificate you probably expect is generated automatically. This makes sense, since you probably want that certificate to be signed by some other certificate authority. To do this, just create a certificate signing request using the key generated on the HSM and pass it over to the certificate authority of your choice. The certificate you are seing right now comes in a format defined in [BSI TR-03110 Part 3](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03110/BSI_TR-03110_Part-3-V2_2.pdf?__blob=publicationFile&v=1) - if I am not mistaken the tags are described in the section “D.2. Data objects” and explanation of each of them is elsewhere in the document. The purpose of this is to have a Card Verifiable Certificate - it certifies that “this key belongs to Nitrokey HSM serial number DENKxxxyyyy0000. This Nitrokey HSM key has been signed by central Nitrokey authority” etc. - see [[Nitrokey HSM] What are C.DevAut and C.DICA? - #2 by sc-hsm](https://support.nitrokey.com/t/nitrokey-hsm-what-are-c-devaut-and-c-dica/2708/2) for some details. If you upload X.509 certificate for the key, this CV certificate gets replaced. --- _[View the full topic](https://support.nitrokey.com/t/nitrokey-hsm-and-certificate-export/3462)._