[Apex Cardano Pool](https://apexpool.info/) and 
[Earn Coin Pool](https://earncoinpool.com/) for documenting the procedure.
{% endhint %}
There are basically 3 main things we need to do in order to add hardware wallet: \
\
**1)** Install cardano-hw-cli on air gapped machine to generate keys. \
\
**2)** Generate new Pool Registration Certificate and build transaction.\
\
**3)** Witness and Submit transaction for new Pool Registration Certificate to the blockchain
## Before we get started
{% hint style="info" %}
**Good to know:** The scripts were tested with a Ledger hardware wallet and using the cardano-hw-cli version 1.16.0-rc.1 (latest available at the time of writing this guide). They should also work with Trezor wallets.
{% endhint %}
{% hint style="warning" %}
The new owner becomes active after **2 full epochs**, the initial owner of the stake pool cannot be replaced with the new one immediately (unless each of the wallets has enough ADA in it to cover the pledge).
After the second owner and its delegation to the stake pool become active, the pledge can be moved from the initial wallet to the hardware wallet and if desired the first wallet can be removed from the stake pool owners. Removing it is optional. **Please note** that you can't use your hardware wallet as payment wallet yet, so you may want to keep your original pledge wallet to use as payment for pool updates.
{% endhint %}
cd $NODE_HOME
sudo dpkg --install ./cardano-hw-cli_1.16.0-rc.1-1.deb
Or If you wish to uninstall `cardano-hw-cli`, run:\ sudo dpkg --remove cardano-hw-cli {% endhint %} ### Part 2 (If using Ledger Device) Now add udev rules by running the following command: ``` sudo bash add_udev_rules.sh ``` ## Step 5 - Generate Verification Key and Hardware Wallet Signing File We will now use `cardano-hw-cli` to extract two files from the hardware wallet:\ \ **1) The stake key verification key `hw-stake.vkey` (".vkey")** \ The `hw-stake.vkey` file will be required when creating the new stake pool registration certificate.\ and\ \ **2)** **The hardware signing file `hw-stake.hwsfile` (".hwsfile")**\ The `hw-stake.hwsfile` file will be required for witnessing transactions with the hardware wallet. {% hint style="info" %} **`hw-stake.vkey`** is not sensitive and may be shared publicly. **`hw-stake.hwsfile`** does NOT contain the raw private key. {% endhint %} {% tabs %} {% tab title="On Air Gapped Machine" %} {% hint style="danger" %} This script must be executed with the hardware wallet connected to the computer and unlocked, and with the Cardano application started. It will be required to confirm the key export on the hardware wallet. {% endhint %} To generate the verification key and hardware wallet signing file, type: ``` cd $NODE_HOME cardano-hw-cli address key-gen \ --path 1852H/1815H/0H/2/0 \ --verification-key-file hw-stake.vkey \ --hw-signing-file hw-stake.hwsfile ``` {% endtab %} {% endtabs %} ## Step 6 - Create New Stake Pool Registration Certificate In order to add a new owner to the stake pool, a new stake pool registration certificate needs to be created. This will secure both your **pool pledge account** and **pool reward account** with a hardware wallet. {% hint style="success" %} Since we need to create a new stake pool registration certificate we are going to walk through how to create an env file that contains our pool information and a script to generate a new certificate. This will allow us to make future pool changes easier and help avoid errors. If you want to skip this step you can see an example command to create new stake pool registration certificate with hardware wallet under the "Standard Method" tab below. {% endhint %} {% hint style="danger" %} **ON Air Gapped Machine** {% endhint %} {% tabs %} {% tab title="Best Practice" %} {% hint style="info" %} Notice the **pool-reward-account** and additional **pool-ownerstake-verification-key-file** lines point to **hw-stake.vkey**. {% endhint %} **1)** First let's start by creating a pool-scripts folder in our $NODE\_HOME. ``` cd $NODE_HOME mkdir pool-scripts ``` **2)** Let's create an env file for our pool in the pool-scripts folder: ``` cat > $NODE_HOME/pool-scripts/env << 'EOF' #!/bin/bash PLEDGE=25000000000 # 25,000 ADA COST=170000000 # 170 ADA MARGIN=0.03 # 3 % NET="--mainnet" #mainnet RELAY1_HOST=relay1.stakepool.url RELAY1_PORT=6000 RELAY2_HOST=relay2.stakepool.url RELAY2_PORT=6000 METADATA_URL=https://stakepool.url/poolmetadata.json METADATA_HASH=$(cat $NODE_HOME/poolMetaDataHash.txt) EOF ``` Edit all the values to match your data. Paths are based on normal coincashew install, please update paths as necessary. The usual values for port are 3001 or 6000, but any valid port can be used. It is also possible to use IP Addresses **3)** Create `pool-registration.sh` script in the pool-scripts folder: ``` cat > $NODE_HOME/pool-scripts/pool-registration.sh << 'EOF' #!/bin/bash source ./env cardano-cli conway stake-pool registration-certificate \ --cold-verification-key-file $HOME/cold-keys/node.vkey \ --vrf-verification-key-file $NODE_HOME/vrf.vkey \ --pool-pledge ${PLEDGE} \ --pool-cost ${COST} \ --pool-margin ${MARGIN} \ --pool-reward-account-verification-key-file $NODE_HOME/hw-stake.vkey \ --pool-owner-stake-verification-key-file $NODE_HOME/stake.vkey \ --pool-owner-stake-verification-key-file $NODE_HOME/hw-stake.vkey \ ${NET} \ --single-host-pool-relay ${RELAY1_HOST} \ --pool-relay-port ${RELAY1_PORT} \ --single-host-pool-relay ${RELAY2_HOST} \ --pool-relay-port ${RELAY2_PORT} \ --metadata-url ${METADATA_URL} \ --metadata-hash ${METADATA_HASH} \ --out-file $NODE_HOME/pool.cert EOF ``` If you are using IP Addresses instead of hostnames for the registered relays, replace `--single-host-pool-relay` with `--pool-relay-ipv4` in the script. You can register as many relays as you want (one or more). You just have to repeat the `--single-host-pool-relay` and `--pool-relay-port` parameters for each of them. The pledge wallet and the rewards wallet are the same one in this case. But it is possible to create and set different wallets for them.\ \ Paths are based on normal coincashew install, please update paths as necessary. **Next:** Add execute permissions to the pool-registration script. ``` chmod +x $NODE_HOME/pool-scripts/pool-registration.sh ``` ⚠️The script must be executed in order to generate the new stake pool registration certificate, which will need to be submitted with a transaction. Run pool-registration script with: ``` cd $NODE_HOME/pool-scripts ./pool-registration.sh ``` {% endtab %} {% tab title="Standard Method" %} {% hint style="info" %} Notice the **pool-reward-account** and additional **pool-ownerstake-verification-key-file** lines point to **hw-stake.vkey**. {% endhint %} In the below example we assume a pledge of 25,000(done in lovelace so 25,000 x 1,000,000), min fee for pool cost at 170(in lovelace as well) and a pool margin of 3%. This example shows sample of 2 ip relays with port 6000 and a sample metadata url, please adjust to match your pool. Please remember to remove <> as well. {% hint style="success" %} Verify the paths to your different keys below {% endhint %} Run the following commands once you update the below with your values, to generate **New Stake Pool Registration Certificate** ``` cd $NODE_HOME cardano-cli stake-pool registration-certificate \ --cold-verification-key-file $HOME/cold-keys/node.vkey \ --vrf-verification-key-file vrf.vkey \ --pool-pledge 25000000000 \ --pool-cost 170000000 \ --pool-margin 0.03 \ --pool-reward-account-verification-key-file hw-stake.vkey \ --pool-owner-stake-verification-key-file stake.vkey \ --pool-owner-stake-verification-key-file hw-stake.vkey \ --mainnet \ --pool-relay-port 6000 \ --pool-relay-ipv4
cd $NODE_HOME
cardano-cli conway transaction witness \
--tx-body-file tx.raw \
--signing-key-file $HOME/cold-keys/node.skey \
--mainnet \
--out-file tx-cold.witness
How to Export Payment Key from Hardware Wallet
ON AIR GAPPED MACHINE with Hardware wallet plugged in and unlocked with Cardano app opened: ``` cd $NODE_HOME cardano-hw-cli address key-gen \ --path 1852H/1815H/0H/0/0 \ --verification-key-file hw-payment.vkey \ --hw-signing-file hw-payment.hwsfile ```cd $NODE_HOME
cardano-hw-cli transaction witness \
--tx-file tx.raw \
--hw-signing-file hw-stake.hwsfile \
--mainnet \
--out-file tx-hw-stake.witness
Clink on "About" tab
