RFC 7030
Enrollment over Secure Transport
Standards Track October 2013
Abstract: EST defines a simple, RESTful protocol for certificate enrollment and management built on HTTPS. It provides an alternative to CMPv2 using standard HTTP methods and TLS for transport security. EST is gaining adoption in 3GPP for automated NF certificate provisioning in cloud-native deployments.
Canonical source: https://www.rfc-editor.org/rfc/rfc7030
| IETF Datatracker
1. Introduction
▶EST (Enrollment over Secure Transport) provides a profile of PKCS#10 certificate enrollment using HTTPS. It is simpler than CMPv2 and leverages existing web infrastructure (HTTP, TLS, REST).
EST is increasingly relevant for 3GPP as 5G core networks adopt cloud-native architectures where containerized NFs need automated certificate provisioning via standard HTTPS APIs.
2. EST Operations
▶| Operation | HTTP Method | URI | Description |
|---|---|---|---|
| CA Certificates | GET | /.well-known/est/cacerts | Retrieve CA certificate chain |
| Simple Enroll | POST | /.well-known/est/simpleenroll | Initial certificate enrollment (PKCS#10 CSR) |
| Simple Re-enroll | POST | /.well-known/est/simplereenroll | Certificate renewal with existing cert auth |
| Full CMC | POST | /.well-known/est/fullcmc | Full CMC enrollment (complex scenarios) |
| CSR Attributes | GET | /.well-known/est/csrattrs | Retrieve required CSR attributes |
| Server-side Keygen | POST | /.well-known/est/serverkeygen | Server generates key pair (RFC 7030bis) |
3. Authentication Methods
▶- Mutual TLS: Client certificate authentication for re-enrollment — NF presents existing certificate
- HTTP Basic/Digest: Username/password for initial enrollment — bootstrapping scenario
- TLS with server-only auth: Client authenticated via HTTP layer credentials
- Token-based: Bearer token (OAuth 2.0) for cloud-native environments
4. EST vs CMPv2 Comparison
▶| Feature | EST (RFC 7030) | CMPv2 (RFC 4210) |
|---|---|---|
| Transport | HTTPS (TLS required) | HTTP, CoAP, or offline |
| Format | PKCS#10 (CSR) / PKCS#7 | ASN.1 CMP messages |
| Complexity | Simple REST API | Complex ASN.1 protocol |
| Authentication | TLS + HTTP auth | MAC or signature in CMP |
| Key update | simplereenroll | kur message |
| Revocation | Not supported (use CRL/OCSP) | rr message |
| 3GPP status | Gaining adoption | Primary protocol (TS 33.310) |
5. Security Considerations
▶- EST relies entirely on TLS for message confidentiality and integrity
- Initial enrollment without client certificate requires careful bootstrap security
- EST server MUST validate CSR attributes and enforce enrollment policies
- Certificate transparency logging SHOULD be considered for operator PKI