1
2
3
4
5

$ wget https://go.dev/dl/go1.25.5.linux-arm64.tar.gz
$ sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.25.5.linux-amd64.tar.gz
$ export PATH=$PATH:/usr/local/go/bin
$ go version
go version go1.25.5 linux/arm64

1
2
3
4
5
6
7
8
9
10
11

$ wget https://github.com/smallstep/certificates/archive/refs/tags/v0.29.0.tar.gz
$ tar -xvzf v0.29.0.tar.gz
$ cd certificates-0.29.0
$ sudo apt install libpcsclite-dev gcc make pkg-config
$ make bootstrap
$ make build GO_ENVS="CGO_ENABLED=1"
$ sudo cp bin/step-ca /usr/local/bin
$ sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/step-ca
$ step-ca version
Smallstep CA/ (linux/arm64)
Release Date: 2025-12-03 14:16 UTC

1
2
3
4
5
6
7
8
9
10

$ wget https://dl.smallstep.com/gh-release/cli/gh-release-header/v0.29.0/step-cli_0.29.0-1_arm64.deb
$ sudo dpkg -i step-cli_0.29.0-1_arm64.deb
$ step version
Smallstep CLI/0.29.0 (linux/arm64)
Release Date: 2025-12-03T04:11:27Z
$ wget https://github.com/smallstep/step-kms-plugin/releases/download/v0.16.0/step-kms-plugin_0.16.0-1_arm64.deb
$ sudo dpkg -i step-kms-plugin_0.16.0-1_arm64.deb
$ step kms version
🔐 step-kms-plugin/0.16.0 (linux/arm64)
   Release Date: 2025-12-04T22:35:43Z

1
2
3
4
5
6
7
8

$ wget https://github.com/OpenSC/OpenSC/releases/download/0.26.1/opensc-0.26.1.tar.gz
$ sudo apt install pcscd libccid libpcsclite-dev libssl-dev libreadline-dev autoconf automake build-essential docbook-xsl xsltproc libtool pkg-config zlib1g-dev 
$ tar xfvz opensc-0.26.1.tar.gz
$ cd opensc-0.26.1
$ ./bootstrap
$ ./configure --prefix=/usr --sysconfdir=/etc/opensc
$ make
$ sudo make install

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

$ curl -LO https://github.com/leetronics/infnoise/archive/refs/tags/0.3.3.tar.gz
$ tar xvzf 0.3.3.tar.gz
$ cd infnoise-0.3.3/software
$ sudo apt install libftdi-dev libusb-dev
$ make -f Makefile.linux
$ sudo make -f Makefile.linux install
$ infnoise --version
GIT VERSION -
GIT COMMIT  -
GIT DATE    -

$ sudo init 6
$ infnoise --debug --no-output
Generated 1048576 bits.  OK to use data.  Estimated entropy per bit: 0.875965, estimated K: 1.835235
num1s:50.019069%, even misfires:0.183222%, odd misfires:0.123520%
Generated 2097152 bits.  OK to use data.  Estimated entropy per bit: 0.873196, estimated K: 1.831716
num1s:49.909786%, even misfires:0.202971%, odd misfires:0.124232%
......

1
2

$ wget https://github.com/polhenarejos/pico-hsm/releases/download/v6.0/pico_hsm_pico2-6.0.uf2
$ wget https://github.com/Gadgetoid/pico-universal-flash-nuke/releases/download/v1.0.1/universal_flash_nuke.uf2

1
2
3

$ mkdir -p certificate-authority/newcerts
$ touch certificate-authority/index.txt
$ openssl ecparam -genkey -name secp384r1 -noout -out root-ca-key.pem

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

[ ca ]

default_ca = CA_default

[ CA_default ]

dir               = certificate-authority
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial


default_md        = sha512

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_strict

[ policy_strict ]


countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]

default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only
prompt              = no


default_md          = sha512

[ req_distinguished_name ]
C                   = CN
O                   = D9Lab
OU                  = D9Lab Zero Certificate Authority
CN                  = D9Lab Zero Root CA

[ v3_ca ]

subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

1

$ openssl req -config create_root_cert.ini -new -key root-ca-key.pem -x509 -days 3650 -sha512 -extensions v3_ca -out root-ca.crt

1
2
3

$ openssl ec -in intermediate_ca_key_enc -out intermediate-ca-key.pem

$ openssl pkcs12 -export -out intermediate-ca.p12 -inkey intermediate-ca-key.pem -in intermediate-ca.crt -certfile root-ca.crt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Inside the unpacked directory you will find scsh3gui, which can be started using bash scsh3gui (for windows double-click on: scsh3gui.cmd).

Start key-manager (File -> Keymanager)
Right-click “Smartcard-HSM” -> create DKEK share
Choose file location
Choose DKEK share password
Right-click “Smartcard-HSM” -> Initialize device
Enter SO-PIN
(optional) Enter label and enter URL/Host
Select authentication method: “User PIN”
Allow RESET RETRY COUNTER: “Resetting and unblocking PIN with SO-PIN not allowed”
Enter and confirm User PIN
“Select Device Key Encryption scheme” -> “DKEK shares”
Enter number of DKEK shares: 1
Right-click DKEK set-up in progress -> “Import DKEK share”
Choose DKEK share file location
Password for DKEK share
Right-click “SmartCard-HSM” -> “Import from PKCS#12(Old)”
Enter number of shares -> 1
Enter file location of DKEK share
Enter Password for DKEK share
Select PKCS#12 container for import (Enter password)
Select Key
Select Name to be used (intermediate-ca)
Import more keys, if needed

1
2
3
4
5
6
7

$ pkcs11-tool -O
  Using slot 0 with a present token (0x0)
  Certificate Object; type = X.509 cert
    label:      intermediate-ca
    subject:    DN: C=CN, O=D9Lab, OU=D9Lab Zero Certificate Authority, CN=D9Lab Zero Intermediate CA
    ID:         01
...

1
2
3
4
5
6
7

intermediate-ca-key.pem
intermediate-ca.crt
intermediate-ca.p12
pde文件（DKEK）
root-ca-key.pem
root-ca.crt
root-ca.p12

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

$ sudo systemctl enable pcscd
$ sudo systemctl start pcscd
$ sudo useradd step
$ sudo passwd -l step
$ sudo mkdir /etc/step-ca
$ export STEPPATH=/etc/step-ca
$ sudo --preserve-env step ca init --name="D9Lab Zero CA" \
    --dns="ca.lab.d9lab.eu.org" --address=":4443" \
    --provisioner="[email protected]" \
    --deployment-type standalone \
    --remote-management


$ sudo rm /etc/step-ca/certs/*

$ sudo rm -rf /etc/step-ca/secrets
$ sudo chown -R step:step /etc/step-ca
$ step kms create --json --kms "pkcs11:module-path=/usr/lib/opensc-pkcs11.so;serial=ESPICOHSMTR?pin-value=648219" "pkcs11:id=2000;object=ssh-host-ca"
$ step kms create --json --kms "pkcs11:module-path=/usr/lib/opensc-pkcs11.so;serial=ESPICOHSMTR?pin-value=648219" "pkcs11:id=2001;object=ssh-user-ca"

1
2
3
4
5
6
7
8
9
10
11
12
13
14

{
    "root": "/etc/step-ca/certs/root-ca.crt",
    "crt": "/etc/step-ca/certs/intermediate-ca.crt",
    "key": "pkcs11:id=01;object=intermediate-ca",
    "kms": {
        "type": "pkcs11",
        "uri": "pkcs11:module-path=/usr/lib/opensc-pkcs11.so;serial=ESPICOHSMTR?pin-value=648219"
    },
	"ssh": {
        "hostKey": "pkcs11:id=2000;object=ssh-host-ca",
        "userKey": "pkcs11:id=2001;object=ssh-user-ca"
    }
}

1
2
3
4

$ screen
$ sudo -u step step-ca /etc/step-ca/config/ca.json

1
2
3
4
5
6
7
8

$ unset STEPPATH
$ step ca bootstrap --ca-url "https://ca.lab.d9lab.eu.org:4443" --fingerprint d6b3b9ef79a42aeeabcd5580b2b516458ddb25d1af4ea7ff0845e624ec1bb609
The root certificate has been saved in /home/disappear9/.step/certs/root_ca.crt.
The authority configuration has been saved in /home/disappear9/.step/config/defaults.json.


$ step ca certificate "localhost" localhost.crt localhost.key
$ step ca provisioner add acme --type acme --admin-name step

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

$ sudo tee /etc/udev/rules.d/75-picohsm.rules > /dev/null << EOF
ACTION=="add", SUBSYSTEM=="usb", ENV{PRODUCT}=="20a0/4230/*", TAG+="systemd", SYMLINK+="picohsm"
ACTION=="remove", SUBSYSTEM=="usb", ENV{PRODUCT}=="20a0/4230/*", TAG+="systemd"
EOF
$ sudo udevadm control --reload-rules
$ sudo tee /etc/systemd/system/step-ca.service > /dev/null << EOF
[Unit]
Description=step-ca
BindsTo=dev-picohsm.device
After=dev-picohsm.device
[Service]
User=step
Group=step
ExecStart=/bin/sh -c '/usr/local/bin/step-ca /etc/step-ca/config/ca.json'
Type=simple
Restart=on-failure
RestartSec=10
[Install]
WantedBy=multi-user.target
EOF
$ sudo mkdir /etc/systemd/system/dev-picohsm.device.wants
$ sudo ln -s /etc/systemd/system/step-ca.service /etc/systemd/system/dev-picohsm.device.wants/
$ sudo systemctl daemon-reload
$ sudo systemctl enable step-ca
$ sudo init 6


$ systemctl status step-ca