# serve-axon-tls (/docs/tx/serve-axon-tls)

Same as `serve_axon` plus a compact neuron certificate stored on chain:
one algorithm byte followed by up to 64 bytes of public key — not an X.509
TLS certificate blob (anything else fails to decode). The chain only
publishes the key for peers to fetch; there is no chain-side TLS
handshake, and running any TLS endpoint is up to the caller. Signed by
the hotkey, which must be registered on the subnet. Use plain
`serve_axon` when peers do not need a published key.

| Signer   | Pallet          | Wraps                            |
| -------- | --------------- | -------------------------------- |
| `hotkey` | SubtensorModule | `SubtensorModule.serve_axon_tls` |

## Parameters [#parameters]

| Parameter     | Type    | Required | Description                                                                                                                                                        |
| ------------- | ------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `netuid`      | integer | yes      | Subnet on which to publish the endpoint.                                                                                                                           |
| `ip`          | string  | yes      | Public IPv4 or IPv6 address of the endpoint, in standard dotted or colon notation.                                                                                 |
| `port`        | integer | yes      | TCP port the endpoint listens on.                                                                                                                                  |
| `certificate` | string  | yes      | Neuron certificate as 0x-prefixed hex: 1 algorithm byte followed by up to 64 bytes of public key. Not an X.509 certificate; other formats fail to decode on chain. |
| `protocol`    | integer | no       | Application protocol tag stored alongside the endpoint; its meaning is subnet-defined.                                                                             |
| `version`     | integer | no       | Version number of the serving neuron's software, stored with the endpoint.                                                                                         |

Address parameters (`--hotkey`, `--coldkey`, `--dest`, ...) accept a raw ss58
address, an address-book or proxy-book name, or a local wallet/hotkey name.

## CLI [#cli]

Preview with `--dry-run` (shows fee, effects, and policy result without
submitting), then submit:

```bash
btcli tx serve-axon-tls \
  --netuid <int> \
  --ip <value> \
  --port <int> \
  --certificate <value> --dry-run
btcli tx serve-axon-tls \
  --netuid <int> \
  --ip <value> \
  --port <int> \
  --certificate <value> -w my_coldkey
```

## Python [#python]

```python
import bittensor as sub
from bittensor.wallet import Wallet

wallet = Wallet(name="my_coldkey", hotkey="my_hotkey")
intent = sub.ServeAxonTls(netuid=1, ip="...", port=0, certificate="...")

async with sub.Client("finney") as client:
    plan = await client.plan(intent, wallet)   # fee, effects, policy — no submission
    result = await client.execute(intent, wallet)
    if not result.success:
        print(result.error.code, result.error.remediation)
```

Or build it by op name, as an agent would:

```python
await client.execute_tool("serve_axon_tls", {...}, wallet)
```