> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy client endpoint

> Instructions for creating a client endpoint in CryptoHub so the strongSwan gateway can reach the deployed service.

After deploying the strongSwan service in CryptoHub, you must create a client endpoint. Endpoints are devices authorized to access this service. In the **Endpoints** menu, you can view and filter details about existing endpoints and add new endpoints.

The endpoint you create here represents the strongSwan gateway. Its identity becomes the PKCS #11 login the FXPKCS11 module presents to CryptoHub, and the downloaded zip contains the library, the configuration file, and the mutual TLS material that authenticate that identity.

<Steps>
  <Step>
    Go to the **Endpoints** menu for the service you deployed.
  </Step>

  <Step>
    In the **Manage Endpoints** menu, select **\[ Add New ]**.
  </Step>

  <Step>
    In the **Add Endpoint** dialog:

    * Enter an identifier for the endpoint, or leave it empty for auto-generation.
    * Confirm the CryptoHub **Hostname** field holds the address clients use to reach the CryptoHub. If CryptoHub auto-populates it, leave the value as is. If the field is empty, enter the CryptoHub FQDN or IP address yourself.
    * Select the **Platform** for the endpoint.

    <Warning>
      CryptoHub auto-populates **Hostname** from its own configured hostname, so the field arrives empty when the CryptoHub has no FQDN configured. An empty value produces an endpoint zip whose `fxpkcs11.cfg` has empty `<ADDRESS>` and `<SERVERNAME>` tags, and the Futurex PKCS #11 library then cannot reach the CryptoHub. Set the field before you create the endpoint, or correct both tags in `fxpkcs11.cfg` afterward.
    </Warning>

    <Note>
      Select the platform that matches the strongSwan host. The platform selection determines which build of `libfxpkcs11.so` CryptoHub places in the zip, so a mismatch produces a library the host cannot load. This guide was validated on Ubuntu 24.04.4 with OpenSSL 3.0.13.
    </Note>
  </Step>

  <Step>
    Select **\[ Add Endpoint ]**. The browser prompts you to download a zip file containing the Futurex PKCS #11 module, TLS certificates, and a configuration file preconfigured to connect to your CryptoHub instance.
  </Step>
</Steps>

<Check>
  The zip contains nine files:

  * `PKCS11Manager`
  * `configTest`
  * `libfxpkcs11.so`
  * `fxpkcs11.cfg`
  * `client-cert.pem`
  * `client.p12`
  * `ca-chain.pem`
  * `CryptoHub <serial>.cer`
  * `Futurex Test Root CA (ECC).cer` or `Futurex Test Root SSL CA.cer`

  The Futurex Test Root certificate is the ECC or the RSA variant depending on the algorithm configured for the connection pair.
</Check>

Deploy one endpoint for each strongSwan gateway that authenticates with a CryptoHub-resident key. In the tunnel test later in this guide, only the responder needs an endpoint; the initiator uses a file-based key.

## Confirm the endpoint role permissions

<Warning>
  Before you continue, confirm the role created for this endpoint carries the six permissions listed in [Before you start](/Integrations/CryptoHub/VPN/strongSwan/Before_you_start). Without the three `CertManage` permissions, every key-generation step later in this guide fails with a client-side error that does not name the missing permission.
</Warning>

<Steps>
  <Step>
    Go to the **Identity and Access** menu and select the **Roles** tab.
  </Step>

  <Step>
    Find the role belonging to the endpoint you just created and open it for editing.
  </Step>

  <Step>
    Confirm the permissions include `CertManage:Add`, `CertManage:Export`, `CertManage:Export Private Key`, `Crypto:Sign`, `Crypto:Verify`, and `Keys:Add`.
  </Step>

  <Step>
    Save any changes.
  </Step>
</Steps>

<Tip>
  To change the endpoint's PIN or password, go to **Identity and Access > Applications & Partitions**. Find the application you deployed, and under **Manage**, select **\[ Authentication ]**. This opens a dialog where you can change the endpoint's PIN or password. Change the PIN before you write it into any configuration file if the auto-generated value does not meet your password policy.
</Tip>