> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy client endpoint

> Instructions for creating a client endpoint in CryptoHub so the step-ca host can reach the deployed service.

After deploying the service in CryptoHub, you must create a client endpoint. Endpoints are devices authorized to access this service. In the **Endpoints** menu, you can view and filter details about existing endpoints and add new endpoints.

The endpoint you create here represents the step-ca host. Its identity becomes the PKCS #11 login the FXPKCS11 module presents to CryptoHub, and the downloaded ZIP contains the library, the configuration file, and the mutual TLS material that authenticate that identity.

<Steps>
  <Step>
    Go to the **Endpoints** menu for the service you deployed.
  </Step>

  <Step>
    In the **Manage Endpoints** menu, select **\[ Add New ]**.
  </Step>

  <Step>
    In the **Add Endpoint** dialog:

    * **Endpoint Identifier**: Enter an identifier or leave it empty for auto-generation.
    * **CryptoHub Hostname**: Leave the auto-populated value as is.
    * **Platform**: Select **Linux OpenSSL 3.x**.

    <Note>
      Select the platform that matches the OpenSSL version on the step-ca host. This guide was validated with **Linux OpenSSL 3.x** on Ubuntu 24.04.4 with OpenSSL 3.0.13. The platform selection determines which build of `libfxpkcs11.so` CryptoHub places in the ZIP, so a mismatch produces a library the host cannot load.
    </Note>
  </Step>

  <Step>
    Select **\[ Add Endpoint ]**. The browser prompts you to download a ZIP file containing the Futurex PKCS #11 module, TLS certificates, and a configuration file preconfigured to connect to your CryptoHub instance.
  </Step>
</Steps>

<Check>
  The ZIP contains nine files:

  * `PKCS11Manager`
  * `configTest`
  * `libfxpkcs11.so`
  * `fxpkcs11.cfg`
  * `client-cert.pem`
  * `client.p12`
  * `ca-chain.pem`
  * `CryptoHub <number>.cer`
  * `Futurex Test Root CA (ECC).cer` or `Futurex Test Root SSL CA.cer`

  The Futurex Test Root certificate is the ECC or the RSA variant depending on the algorithm configured for the connection pair.
</Check>

<Tip>
  To change the endpoint's PIN or password, go to **Identity and Access > Applications & Partitions**. Find the application you deployed, and under **Manage**, select **\[ Authentication ]**. This opens a dialog where you can change the endpoint's PIN or password. Change the PIN before you write it into any configuration file if the auto-generated value does not meet your password policy.
</Tip>