Skip to main content
After deploying the strongSwan service in CryptoHub, you must create a client endpoint. Endpoints are devices authorized to access this service. In the Endpoints menu, you can view and filter details about existing endpoints and add new endpoints. The endpoint you create here represents the strongSwan gateway. Its identity becomes the PKCS #11 login the FXPKCS11 module presents to CryptoHub, and the downloaded zip contains the library, the configuration file, and the mutual TLS material that authenticate that identity.
1
Go to the Endpoints menu for the service you deployed.
2
In the Manage Endpoints menu, select [ Add New ].
3
In the Add Endpoint dialog:
  • Enter an identifier for the endpoint, or leave it empty for auto-generation.
  • Confirm the CryptoHub Hostname field holds the address clients use to reach the CryptoHub. If CryptoHub auto-populates it, leave the value as is. If the field is empty, enter the CryptoHub FQDN or IP address yourself.
  • Select the Platform for the endpoint.
CryptoHub auto-populates Hostname from its own configured hostname, so the field arrives empty when the CryptoHub has no FQDN configured. An empty value produces an endpoint zip whose fxpkcs11.cfg has empty <ADDRESS> and <SERVERNAME> tags, and the Futurex PKCS #11 library then cannot reach the CryptoHub. Set the field before you create the endpoint, or correct both tags in fxpkcs11.cfg afterward.
Select the platform that matches the strongSwan host. The platform selection determines which build of libfxpkcs11.so CryptoHub places in the zip, so a mismatch produces a library the host cannot load. This guide was validated on Ubuntu 24.04.4 with OpenSSL 3.0.13.
4
Select [ Add Endpoint ]. The browser prompts you to download a zip file containing the Futurex PKCS #11 module, TLS certificates, and a configuration file preconfigured to connect to your CryptoHub instance.
The zip contains nine files:
  • PKCS11Manager
  • configTest
  • libfxpkcs11.so
  • fxpkcs11.cfg
  • client-cert.pem
  • client.p12
  • ca-chain.pem
  • CryptoHub <serial>.cer
  • Futurex Test Root CA (ECC).cer or Futurex Test Root SSL CA.cer
The Futurex Test Root certificate is the ECC or the RSA variant depending on the algorithm configured for the connection pair.
Deploy one endpoint for each strongSwan gateway that authenticates with a CryptoHub-resident key. In the tunnel test later in this guide, only the responder needs an endpoint; the initiator uses a file-based key.

​
Confirm the endpoint role permissions

Before you continue, confirm the role created for this endpoint carries the six permissions listed in Before you start. Without the three CertManage permissions, every key-generation step later in this guide fails with a client-side error that does not name the missing permission.
1
Go to the Identity and Access menu and select the Roles tab.
2
Find the role belonging to the endpoint you just created and open it for editing.
3
Confirm the permissions include CertManage:Add, CertManage:Export, CertManage:Export Private Key, Crypto:Sign, Crypto:Verify, and Keys:Add.
4
Save any changes.
To change the endpoint’s PIN or password, go to Identity and Access > Applications & Partitions. Find the application you deployed, and under Manage, select [ Authentication ]. This opens a dialog where you can change the endpoint’s PIN or password. Change the PIN before you write it into any configuration file if the auto-generated value does not meet your password policy.