> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prepare CryptoHub

> Create the ML-DSA root CA, deploy the Microsoft ADCS service, download its Windows endpoint bundle, and grant the service access to the certificate container in CryptoHub 7.2.0.x.

Prepare the CryptoHub side of the integration by creating the ML-DSA root CA, deploying a Microsoft ADCS client service, and granting the service access to the certificate container.

## Create a certificate container

<Steps>
  <Step>
    Log in to CryptoHub under dual control with your administrator identities.
  </Step>

  <Step>
    In the left navigation, select **PKI & CA**, and then open **Certificate Management**.
  </Step>

  <Step>
    Create a certificate container for the CA hierarchy, or select an existing container that is governed by the required access policy.

    <Check>
      The certificate container appears in the **Certificate Management** table.
    </Check>
  </Step>
</Steps>

## Create the ML-DSA root CA

<Steps>
  <Step>
    Right-click the certificate container, and then select **Add Certificate** > **New Certificate**.

    <Check>
      The certificate window opens with **Subject DN**, **Basic Info**, and **V3 Extensions** tabs.
    </Check>
  </Step>

  <Step>
    On **Subject DN**, enter the distinguished-name values for the root CA. Use your organization's naming policy.
  </Step>

  <Step>
    On **Basic Info**, configure the root key:

    * Set **Type** to **ML-DSA**.
    * Set **Major key** to **PMK**.
    * Set **Size** to **ML-DSA-44**, **ML-DSA-65**, or **ML-DSA-87**.
    * Set **Usage** to **Sign/Verify**.
    * Set **Security Usage** to **Anonymous Signing**.
    * Set **Storage** to **HSM Trusted**.
    * Set the signing hash value according to your root CA policy.
    * Set the validity period according to your root CA policy.
  </Step>

  <Step>
    On **V3 Extensions**, select the **Certificate Authority** profile.

    <Note>
      The root CA certificate does not need a **CRL Distribution Points** extension. Windows does not check revocation for a trusted self-signed root. Add the extension only if your PKI policy requires it. You add the extension to the subordinate CA certificate in [Configure the ML-DSA subordinate CA](./configure-ml-dsa-subordinate-ca).
    </Note>
  </Step>

  <Step>
    Select **OK** to start the generation job.

    <Check>
      After the job completes, the root CA appears beneath the certificate container with **Self-signed** in **Notes** and **Valid** in **Status**.
    </Check>
  </Step>
</Steps>

## Deploy the Microsoft ADCS service

<Steps>
  <Step>
    Return to the CryptoHub home page and locate **Microsoft ADCS** in the service store. Select **Deploy**.
  </Step>

  <Step>
    On **Service Setup**:

    * Enter a unique **Service Name**.
    * Keep or update the **Service Category**.

    Select **Next**.
  </Step>

  <Step>
    On **Access Control**, confirm the authorized resources. Add any additional role or partition that must administer this service, and then select **Next**.
  </Step>

  <Step>
    On **Service Info**, keep the default authentication mechanism and then select **Deploy**.

    <Check>
      The Microsoft ADCS service appears under **Deployed Services** and reports a successful deployment.
    </Check>
  </Step>
</Steps>

## Create a client endpoint

<Steps>
  <Step>
    Open the deployed Microsoft ADCS service, and then select **Endpoints**.
  </Step>

  <Step>
    Under **Manage Endpoints**, select **Add New**.
  </Step>

  <Step>
    Configure the endpoint:

    * Enter a unique **Endpoint Identifier** or leave empty for auto-generation.
    * Keep the auto-populated **CryptoHub Hostname**.
    * Choose either **ECC** or **RSA** for the **Client Connection Type**.
    * Set **Platform** to **Windows 64-bit**.

    Select **Add Endpoint**.
  </Step>

  <Step>
    Save the downloaded endpoint zip.

    <Check>
      The download contains `cryptohub-cng.dll`, `cng-install.exe`, `cng-uninstall.exe`, `cng-manager.exe`, a pre-filled `cryptohub.json`, and the TLS files referenced by that configuration.
    </Check>
  </Step>
</Steps>

## Grant the service access to the certificate container

Give the Microsoft ADCS service role permission to use the certificate container that holds the ML-DSA root CA.

<Steps>
  <Step>
    In CryptoHub, select **PKI & CA** > **Certificate Management**.
  </Step>

  <Step>
    Right-click the certificate container that holds the ML-DSA root CA, and then select **Permission**.
  </Step>

  <Step>
    In the drop-down list next to **Add**, select **Service - SERVICE\_NAME**, where `SERVICE_NAME` is the **Service Name** you entered when you deployed the Microsoft ADCS service. Then select **Add**.
  </Step>

  <Step>
    In the new row, set **Permission** to **Use**.
  </Step>

  <Step>
    In the drop-down list below the table, select **Apply to selected objects and all children**.
  </Step>

  <Step>
    Select **Save**.

    <Check>
      The permissions table lists the role for the service with **Use** permission. CryptoHub names this role after the service, for example `SERVICE_NAME-Microsoft ADCS-NUMBER`.
    </Check>
  </Step>
</Steps>

Continue to [Install and configure CryptoHub CNG](./install-and-configure-cryptohub-cng).