EST

Mesh Nodes can expose an RFC 7030 Enrollment over Secure Transport (EST) service for equipment and applications that speak EST rather than ACME. EST is only a protocol front end: every request becomes the same Sectigo Edge issuance transaction, with local policy, the approval quorum and the protected signer. Private keys are generated and kept by the EST client — the node never accepts, generates, exports or escrows them.

Supported operations

Operation	Endpoint	Behavior
CA certificates	GET /.well-known/est/cacerts	CMS certs-only response with the configured root and intermediates
Profile CA certificates	GET /.well-known/est/<profile>/cacerts	Only when <profile> is the exact active desired-state profile
CSR attributes	GET …/csrattrs	204 No Content — no extra attributes are requested
Enrollment	POST …/simpleenroll	Authenticated PKCS#10 issuance
Re-enrollment	POST …/simplereenroll	Also requires the same subject and DNS SANs as the current client certificate

Full CMC and server-side key generation are not supported.

Authentication and request rules

1. TLS 1.3 with a client certificate that chains to the node's workload trust bundle.
2. The certificate must carry exactly one canonical SPIFFE URI in your workload trust domain. HTTP Basic/Digest passwords and reusable EST credentials are not accepted.
3. Requests use Content-Type: application/pkcs10 with base64 transfer encoding. The CSR must have a valid proof-of-possession signature, a supported key, 1–100 unique DNS SANs, no other SAN type, no CA capability and no unsupported extension.
4. The active desired state selects the certificate profile; a profile label in the URL cannot select a different one.
5. Normal node policy checks requester, SAN scope, algorithm, lifetime, policy version and kill switches.
6. Before replying, the node checks that the leaf has the CSR's public key, subject and SANs, no added SAN types or CA capability, and chains to the configured EST CA bundle.
7. The reply is a base64 CMS certs-only response and carries the Sectigo Edge transaction ID.

If transport, quorum or signer are temporarily delayed, the node answers 202 Accepted with Retry-After. Retrying the identical request recovers the same transaction — it never authorizes a second certificate. Definitive policy or protocol rejections are final.

Requirements

• An enrolled node (any platform; Helm values are provided for Kubernetes).
• The public CA chain (root plus every intermediate needed to build the issuing chain) as a PEM file — certificates only, never a private key.
• EST clients with a SPIFFE client certificate from your workload CA.

Node configuration

Kubernetes

workstation (bash)

$ kubectl -n edgepki create secret generic edgepki-est-ca-bundle \
>   --from-file=ca-bundle.pem=est-ca-chain.pem
secret/edgepki-est-ca-bundle created
$ helm upgrade mesh ./edgepki-node --namespace edgepki --reuse-values \
>   --set est.enabled=true \
>   --set est.adapterReference=local/est-builtin

Linux / Windows

Add to config.json, then validate and restart:

{
  "est_enabled": true,
  "est_adapter_reference": "local/est-builtin",
  "est_ca_certificate_bundle_file": "/etc/edgepki/est-ca-chain.pem"
}

est_ca_certificate_bundle_file must be an absolute path (on Windows, for example C:\\ProgramData\\Sectigo\\Edge\\est-ca-chain.pem in JSON).

The listener stays inactive until desired state assigns the exact adapter reference and a profile to the node.

Configure in the console

1. Open Console›Integrations and select Configure on EST.
2. Select Enable this integration and the target node(s).
3. Select the Certificate / identity profile for EST issuance (required).
4. Enter the Local adapter reference — exactly est_adapter_reference (default local/est-builtin).
5. Select Save desired state.

The console stores the reference but never receives a CA private key, HSM PIN, workload trust key or client credential.

Authority withdrawal

Disabling EST or removing the node from it arrives as a tombstone: the node immediately stops serving enrollment, re-enrollment, /cacerts and profile discovery. During a temporary control-plane outage the node keeps its last authenticated desired state so local operation continues; a received disablement is final and does not fail back to cloud issuance.

Policy and renewal

EST requests are evaluated with deployment mode est_enroll or est_reenroll against the selected profile's requester, SAN, algorithm and lifetime rules. Devices renew with simplereenroll before expiry; subject or SAN changes are rejected. There is no dual-slot activation for EST.

Verify

device-lab (bash)

$ curl -s --cacert local-api-ca.pem --cert device-svid.pem --key device-svid-key.pem \
>   https://mesh-node.example:9443/.well-known/est/cacerts \
>   | base64 -d | openssl pkcs7 -inform DER -print_certs -noout
subject=CN = Acme Corp Issuing CA 01
issuer=CN = Acme Corp Root CA

subject=CN = Acme Corp Root CA
issuer=CN = Acme Corp Root CA

$ curl -s --cacert local-api-ca.pem --cert device-svid.pem --key device-svid-key.pem \
>   -H 'Content-Type: application/pkcs10' -H 'Content-Transfer-Encoding: base64' \
>   --data-binary @device.csr.b64 \
>   https://mesh-node.example:9443/.well-known/est/simpleenroll -o device.p7.b64 -w '%{http_code}\n'
200

Example output. A 202 means the transaction is still being approved — retry the same request after the Retry-After interval. Also check the card is Healthy and run:

mesh-node-01 (bash)

$ sectigo-edge -url https://mesh-node.example:9443 \
>   -ca workload-ca.pem -cert workload-svid.pem -key workload-svid-key.pem \
>   integrations

The EST entry shows "installed": true, "assigned": true, "health": "healthy", the profile_id and the revision. Before production, qualify real devices, load, renewal, signer outage, desired-state withdrawal, CA rollover and HSM-backed signing.

Troubleshooting

Code or symptom	Meaning	What to do
est_not_configured	The assigned node has no EST settings	Enable EST on the node
adapter_reference_invalid	Console and node references differ	Make them identical
profile_not_configured	No profile selected	Select a profile
EST endpoints return not found / unavailable	EST disabled, node unassigned, or the URL profile is not the active one	Check desired state and the profile in the URL
401 / TLS handshake failure	No client certificate, untrusted chain, or not exactly one SPIFFE URI	Use a proper workload SVID
Request rejected	Wrong content type or encoding, more than 100 or zero DNS SANs, non-DNS SANs, CA flag, unsupported extension, or policy denial	Fix the CSR or the profile
Re-enrollment rejected	Subject or DNS SANs differ from the current certificate	Re-enroll with identical identity, or use simpleenroll