# Using step-ca with a Nitrokey-HSM

**URL:** https://support.nitrokey.com/t/using-step-ca-with-a-nitrokey-hsm/7539
**Category:** HSM
**Created:** [March 23, 2026, 8:17am UTC](https://support.nitrokey.com/t/using-step-ca-with-a-nitrokey-hsm/7539 "2026-03-23T08:17:36Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![sc-hsm](https://support.nitrokey.com/user_avatar/support.nitrokey.com/sc-hsm/32/304_2.png) [@sc-hsm](https://support.nitrokey.com/u/sc-hsm)
#### Post date: [March 23, 2026, 8:17am UTC](https://support.nitrokey.com/t/using-step-ca-with-a-nitrokey-hsm/7539/1 "2026-03-23T08:17:36Z")

</div>

[step-ca](https://github.com/smallstep/certificates) from smallstep is a great tool to automate certificate enrollment.

And it [integrates well with a Nitrokey-HSM](https://www.smartcard-hsm.com/2026/03/21/integrate-with-step-ca.html) using PKCS#11.

What is missing though, is a good integration if step-ca is used as cloud service. Ideally one could connect a local Nitrokey-HSM with the step-ca service using [RAMOverHTTP](https://www.pki-as-a-service.org/um/cloud-hsm/), however that would require to implement the full HSMService in go, which is the programing language used for step-ca.

We are following a different route by adding an OpenAPI to the HSM-Service in the core service in the PKIaaS. That way you can deploy step-ca and PKIaaS side-by-side, use PKIaaS to manage the HSM and access keys for signing certificates via the API. Of course that approach could also be used to integrate other cloud-based services requiring access to keys on a Nitrokey-HSM.

Integrating step-ca and PKIaaS also opens the opportunity to use PKIaaS as provisioner for step-ca issued certificates that end-up on a HSM. Just like the EJBCA or DFN-PKI service does.