View source for Enrollment over Secure Transport

{{Short description|Cryptographic protocol}}

{{IPstack}}
The '''Enrollment over Secure Transport''', or '''EST''' is a cryptographic protocol that describes an [[X.509]] certificate management protocol targeting [[Public key infrastructure|public key infrastructure]] (PKI) clients that need to acquire client certificates and associated [[Certificate authority|certificate authority]] (CA) certificates. EST is described in {{IETF RFC|7030}}. EST has been put forward as a replacement for [[Simple Certificate Enrollment Protocol|SCEP]], being easier to implement on devices already having an HTTPS stack. EST uses HTTPS as transport and leverages [[Transport Layer Security|TLS]] for many of its security attributes. EST has described standardized URLs and uses the well-known Uniform Resource Identifiers (URIs) definition codified in {{IETF RFC|5785}}.

==Operations==
EST has a following set of operations:

{| class="wikitable"
|-
! style="width: 25%;"| API Endpoint !! style="width: 15%;"| Operation !! style="width: 65%;"| Description
|-
| /.well-known/est/cacerts || Distribution of CA Certificates || The EST client can request a copy of the current CA certificates with HTTP GET operation (RFC 7030 [https://tools.ietf.org/html/rfc7030#section-4.1 Section 4.1]).
|-
| /.well-known/est/simpleenroll || Enrollment of Clients || EST clients request a certificate from the EST server with an HTTPS POST operation (RFC 7030 [https://tools.ietf.org/html/rfc7030#section-4.2 Section 4.2]).
|-
| /.well-known/est/simplereenroll || Re-enrollment of Clients || EST clients renew/rekey certificates with an HTTPS POST operation (RFC 7030 [https://tools.ietf.org/html/rfc7030#section-4.2.2 Section 4.2.2]).
|-
| /.well-known/est/fullcmc || Full CMC || An EST client can request a certificate from an EST server with an HTTPS POST operation (RFC 7030 [https://tools.ietf.org/html/rfc7030#section-4.3 Section 4.3]).
|-
| /.well-known/est/serverkeygen || Server-Side Key Generation || An EST client may request a private key and associated certificate from an EST server using an HTTPS POST operation (RFC 7030 [https://tools.ietf.org/html/rfc7030#section-4.4 Section 4.4])
|-
| /.well-known/est/csrattrs || CSR Attributes || CA policy may allow inclusion of client-provided attributes in certificates that it issues, and some of these attributes may describe information that is not available to the CA.  In addition, a CA may desire to certify a certain type of public key and a client may not have a priori knowledge of that fact. Therefore, clients SHOULD request a list of expected attributes that are required, or desired, by the CA in an enrollment request or if dictated by local policy. (RFC 7030 [https://tools.ietf.org/html/rfc7030#section-4.5 Section 4.5])
|}

==Usage example==
The basic functions of EST were designed to be easy to use and although not a [[Representational state transfer|REST API]], it can be used in a REST-like manner using simple tools such as [[Software:OpenSSL|OpenSSL]] and [[Software:CURL|cURL]]. A simple command to make initial enrollment with a pre-generated PKCS#10 [[Certificate signing request|Certificate Signing Request]] (stored as device.b64), using one of the authentication mechanisms (username:password) specified in EST is:

{{code |lang=bash|curl -v --cacert ManagementCA.cacert.pem --user username:password --data @device.b64 -o device-p7.b64 -H "Content-Type: application/pkcs10" -H "Content-Transfer-Encoding: base64" https://hostname.tld/.well-known/est/simpleenroll}}

The issued certificate, returned as a Base64 encoded [[PKCS 7|PKCS#7]] message, is stored as device-p7.b64.

==See also==
* [[Certificate Management Protocol]] (CMP)
* [[Certificate Management over CMS]] (CMC)
* [[Simple Certificate Enrollment Protocol]] (SCEP)
* [[Automated Certificate Management Environment]] (ACME)

==References==
{{Reflist}}
* {{IETF RFC|7030}}, official specification

==Implementations==
{{Refexample|section|date=November 2017}}
* The library [https://github.com/cisco/libest libest] is a client and server implementation of EST.
* [https://www.bouncycastle.org/ Bouncy Castle API] offers EST API library for Java.
* [https://www.digicert.com/iot-trust-manager DigiCert IoT Trust Manager] is a server implementation of EST.
* [[Software:EJBCA|EJBCA]], a [[Certificate authority|CA]] software, implements a subset<ref>{{Cite web |url=https://ejbca.org/features.html |title=EJBCA - The Java EE Certificate Authority |access-date=2019-06-07 |archive-url=https://web.archive.org/web/20190607065910/https://ejbca.org/features.html |archive-date=2019-06-07 |url-status=dead }}</ref> of the EST functions.
* [https://www.evertrust.fr/horizon Evertrust Horizon] implements {{IETF RFC|7030}}.
*[[Company:Entrust|Entrust]] [[Certificate authority|CA]] PKIs support EST functions
* [https://www.sectigo.com/resource-library/what-is-enrollment-over-secure-transport Sectigo Certificate Manager] implements {{IETF RFC|7030}}.
*The [[Software:StrongSwan|strongSwan]] [https://docs.strongswan.org/docs/5.9/pki/pkiEst.html pki --est] tool is a client implementation of EST.
[[Category:Public key infrastructure]]
[[Category:Cryptographic protocols]]
[[Category:Computer security]]
[[Category:Internet Standards]]



{{Sourceattribution|Enrollment over Secure Transport}}