Deploy client endpoint - Futurex Documentation

After deploying the service in CryptoHub, you must create a client endpoint. Endpoints are devices authorized to access this service. In the Endpoints menu, you can view and filter details about existing endpoints and add new endpoints. The endpoint you create here represents the step-ca host. Its identity becomes the PKCS #11 login the FXPKCS11 module presents to CryptoHub, and the downloaded ZIP contains the library, the configuration file, and the mutual TLS material that authenticate that identity.

Go to the Endpoints menu for the service you deployed.

In the Manage Endpoints menu, select [ Add New ].

In the Add Endpoint dialog:

Endpoint Identifier: Enter an identifier or leave it empty for auto-generation.
CryptoHub Hostname: Leave the auto-populated value as is.
Platform: Select Linux OpenSSL 3.x.

Select the platform that matches the OpenSSL version on the step-ca host. This guide was validated with Linux OpenSSL 3.x on Ubuntu 24.04.4 with OpenSSL 3.0.13. The platform selection determines which build of libfxpkcs11.so CryptoHub places in the ZIP, so a mismatch produces a library the host cannot load.

Select [ Add Endpoint ]. The browser prompts you to download a ZIP file containing the Futurex PKCS #11 module, TLS certificates, and a configuration file preconfigured to connect to your CryptoHub instance.

The ZIP contains nine files:

PKCS11Manager
configTest
libfxpkcs11.so
fxpkcs11.cfg
client-cert.pem
client.p12
ca-chain.pem
CryptoHub <number>.cer
Futurex Test Root CA (ECC).cer or Futurex Test Root SSL CA.cer

The Futurex Test Root certificate is the ECC or the RSA variant depending on the algorithm configured for the connection pair.

To change the endpoint’s PIN or password, go to Identity and Access > Applications & Partitions. Find the application you deployed, and under Manage, select [ Authentication ]. This opens a dialog where you can change the endpoint’s PIN or password. Change the PIN before you write it into any configuration file if the auto-generated value does not meet your password policy.

⌘I