> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy client endpoint

> Procedure for creating the client endpoint that authorizes the Certificate Manager host to access the Nexus PKI service.

After deploying the service in CryptoHub, create a client endpoint for the Certificate Manager host. Endpoints are devices authorized to access this service. In the **Endpoints** menu, you can view and filter details about existing endpoints and add new endpoints.

<Steps>
  <Step>
    Go to the **Endpoints** menu for the service you deployed.
  </Step>

  <Step>
    In the **Manage Endpoints** menu, select **\[ Add New ]**.
  </Step>

  <Step>
    In the **Add Endpoint** dialog:

    * Enter an identifier, or leave it empty for auto-generation.
    * Leave the auto-populated CryptoHub **Hostname** as is. Certificate Manager connects to this hostname, so it must resolve from the Certificate Manager host.
    * Select **Windows** as the **Platform**.
  </Step>

  <Step>
    Select **\[ Add Endpoint ]**.

    The browser downloads a ZIP file containing the Futurex PKCS #11 module (`fxpkcs11.dll`), TLS certificates, and a configuration file (`fxpkcs11.cfg`) preconfigured to connect to your CryptoHub.
  </Step>
</Steps>

<Warning>
  The endpoint ZIP contains the client TLS credentials and the PKCS #11 PIN for the service. Transfer it to the Certificate Manager host over a secure channel and delete the downloaded copy after you install it.
</Warning>

<Note>
  To change the PIN for an endpoint, go to the **Identity and Access** menu and select the **Applications & Partitions** tab. Find the application you deployed, and in the **Manage** section, select **\[ Authentication ]**. This opens a dialog where you can change the PIN for the endpoint.
</Note>