EST Protocol (Enrollment over Secure Transport)

Overview

QCecuring implements the Enrollment over Secure Transport (EST) protocol defined in RFC 7030, providing a modern, TLS-secured method for certificate enrollment and renewal. EST offers improved security over SCEP by leveraging HTTPS transport and supporting certificate-based client authentication.

Key capabilities

• Built-in EST server supporting simple enrollment, re-enrollment, and CA certificate distribution.
• Client certificate and HTTP Basic authentication for enrollment request validation.
• Server-side key generation for devices unable to generate their own key pairs.
• Integration with QCecuring’s policy engine for enrollment authorization decisions.
• Full audit trail of EST enrollment operations with client identity and certificate metadata.

Typical use cases

• IoT device manufacturers using EST for secure initial certificate provisioning.
• Organizations migrating from SCEP to EST for improved enrollment security.
• Network infrastructure teams using EST for automated certificate renewal on modern equipment.

High-level integration flow

1. Enable QCecuring’s EST server endpoint and configure TLS, authentication, and issuing CA settings.
2. Distribute the EST server’s CA certificates to clients for trust establishment.
3. Clients authenticate and submit enrollment requests over HTTPS to QCecuring’s EST endpoint.
4. QCecuring validates client identity, applies enrollment policies, and issues certificates.
5. Enrolled certificates are managed in QCecuring’s inventory with EST-based re-enrollment for renewals.