Deploy client endpoint - Futurex Documentation

Service guides

Certificate Authority

Certificate management

Certificate validation

Cloud key management

Code signing

Credential management

Data protection

Data storage

Database

Digital signing

DNS

Endpoint management

Firewall

Generic

IT automation and orchestration

Key management

Privileged access management

Secrets management

SSH

TLS offloading

Virtualization

VPN

After deploying the service in CryptoHub, create a client endpoint for the SAP ASE host. Endpoints are devices authorized to access this service. In the Endpoints menu, you can view and filter details about existing endpoints and add new endpoints.

Go to the Endpoints menu for the service you deployed.

In the Manage Endpoints menu, select [ Add New ].

In the Add Endpoint dialog:

Enter an identifier, or leave it empty for auto-generation.
Leave the auto-populated CryptoHub Hostname as is. SAP ASE connects to this hostname, so it must resolve from the SAP ASE host.
Select OpenSUSE 15.0 as the Platform.

Select [ Add Endpoint ].The browser downloads a ZIP file containing the Futurex PKCS #11 module (libfxpkcs11.so), TLS certificates, and a configuration file (fxpkcs11.cfg) preconfigured to connect to your CryptoHub.

The endpoint ZIP contains the client TLS credentials and the PKCS #11 PIN for the service. Transfer it to the SAP ASE host over a secure channel and delete the downloaded copy after you install it.

To change the PIN for an endpoint, go to the Identity and Access menu and select the Applications & Partitions tab. Find the application you deployed, and in the Manage section, select [ Authentication ]. This opens a dialog where you can change the PIN for the endpoint. Then store the new PIN in SAP ASE with sp_encryption 'hsm_credential'.