Deploy a client endpoint - Futurex Documentation

Create a client endpoint to authorize the KMIP application to use the Generic KMIP service, and protect the downloaded bundle as a credential.

The endpoint ZIP contains the client private key and the password for its PKCS #12 file. Store it in a protected location, and do not send it through email or copy it into an image.

Open endpoint management

Open Services, select the Deployed Services tab, and select the Generic KMIP service that you deployed. Select ENDPOINTS.

CryptoHub displays the Manage Endpoints page for the service.

Add the endpoint

Select ADD NEW. In the Add Endpoint dialog, complete these fields:

Endpoint Identifier: a name that identifies the application host, at least 4 characters. If you leave it empty, CryptoHub generates one.
CryptoHub Hostname: the CryptoHub FQDN that the application uses to reach CryptoHub. CryptoHub fills in the address that your browser used, and writes this value to info.txt as the KMIP address.
Client Connection Type: ECC for an ECC client certificate, or RSA for an RSA client certificate. Select the type that the application requires.

The dialog shows your values in all three fields.

Download the endpoint

Select ADD ENDPOINT and save the downloaded ZIP in a protected administrator directory.

CryptoHub displays Endpoint created, and the browser downloads a ZIP named after the endpoint identifier.

Record the KMIP address

Open info.txt and record the service name and the address. Use this address in the application’s KMIP settings.

info.txt names the service that you deployed, and its address ends with :5696.

Endpoint ZIP contents

File	Description
`ca-chain.pem`	CA certificate bundle. The application uses it to verify the CryptoHub KMIP server certificate. It also contains the CA that issued the client certificate.
`client-cert.pem`	Client TLS certificate for the endpoint.
`credential.txt`	Identity name that CryptoHub created for the endpoint.
`info.txt`	Service name, service identifier, and the KMIP address in the form `<CryptoHub Hostname>:5696`.
`pki.p12`	Full client PKI in encrypted PKCS #12 format: the CA chain, the client certificate, and the client private key.
`pki-password.txt`	Password for `pki.p12`.
`Client App TLS CA <number>.cer`	CA certificate that CryptoHub uses to issue client endpoint TLS certificates. The number is specific to your CryptoHub.
`Futurex Test Root CA (ECC).cer` and `Futurex Test Root SSL CA.cer`	Futurex test root CAs for the embedded Futurex test TLS certificates.

The ZIP does not contain the KMIP server certificate. The application receives it during the TLS handshake. Configure ca-chain.pem as the application’s server CA.

Each endpoint has its own identity and client certificate. Create a separate endpoint for each application host or cluster member that needs its own credential.

​Endpoint ZIP contents

Endpoint ZIP contents