EST Service Configuration¶
Overview¶
Enrollment over Secure Transport (EST) enables automated certificate enrollment for devices and services using the protocol defined in RFC 7030. An EST configuration in the LAAVAT Platform maps Certificate Authorities, each belonging to a product, to the EST service endpoint, allowing clients to request certificates through a standardized, secure interface.
The GUI takes you through this in one screen: Admin → Est Service, then the + button opens Create configuration, where the CAs to publish are picked from a transfer list. Submitting creates a configuration request, which takes effect once it has been approved.
When to use EST
EST is the recommended approach for automated device certificate enrollment in production environments. It provides mutual TLS authentication, supports certificate renewal, and integrates with existing PKI infrastructure without requiring custom API integration.
Product Selection¶
The first step in configuring the EST service is selecting which Certificate Authorities should be available through the EST endpoint.
Available CAs¶
The available list is built from Certificate Authorities rather than from products: each entry is a single CA, shown with the product it belongs to underneath. A CA appears in the list when both of the following hold.
- The product is of type Production, RnD or CA. CA products hold the PKI CA and certificate issuance operations, so their enrollment CAs are offered alongside those of ordinary products.
- The CA's use case is Device CA or GenUse0. These are the use cases that issue device enrollment certificates. CAs for other use cases — code signing, encryption, and the generic slots GenUse1 to GenUse9 — are not offered for EST.
A product that has both a Device CA and a GenUse0 CA contributes one entry per CA, so the same product name can appear on more than one row.
Transfer List¶
The selection uses a transfer list interface with two columns:
| Column | Description |
|---|---|
| Available (left) | Eligible CAs that have not yet been selected for EST. |
| Selected (right) | CAs that will be accessible through the EST service endpoint. |
Tick the entries you want to move, then use the controls between the columns:
| Control | Effect |
|---|---|
| > | Move the ticked entries from Available to Selected. |
| < | Move the ticked entries from Selected back to Available. |
| ≫ | Move every entry to Selected. |
| ≪ | Move every entry back to Available. |
There is no search field: the columns are plain lists, so on a large installation expect to scroll.
While the page loads, both boxes show a spinner. Building the list means reading the CAs of every product, which on a large installation takes a few seconds.
Starting from the Current Configuration¶
The Selected column is pre-filled with the configuration that is in effect. Exactly one configuration is active at a time: the request in the Ready state. Requests that are still waiting for approval, or that were rejected, are not the live configuration and are ignored.
This means you edit the live configuration rather than rebuilding it: move across what you want to add, move back what you want to withdraw, and leave the rest alone. It matters because an approved request replaces the configuration — a CA you never touch has to still be in the Selected column when you send the request.
A configured CA that is no longer offered
If the configuration contains a CA that no longer appears under any product — its product was removed, or its use case changed — the entry is still shown in the Selected column, labelled Not offered by any listed product. It is kept so that sending the request does not drop it by omission. Move it back to Available only if you intend to withdraw it.
CA Selection¶
The Selected column is the configuration: the CAs it holds are the ones the request will publish through the EST endpoint. There is no separate enable or disable step, and no per-CA status to toggle — a CA is either in the Selected column or it is not.
What the Request Contains¶
Each entry is sent as a CA name and CA id. A request always describes the complete set of CAs you moved across.
An approved request replaces the EST service configuration. It is not merged with what was configured before: once the request is approved, the CAs in its Selected column are the configuration, and any CA that is not in it is no longer published through the EST endpoint.
Omitting a CA removes it
Because approval replaces the whole configuration, a CA that is not in the Selected column when you send the request is dropped from the EST service as soon as the request is approved. EST clients that enroll against it stop being able to obtain certificates until a later request reinstates it. The Selected column starts from the configuration in effect, so the CAs already in use are there when you open the page — move one back to Available only when you mean to withdraw it.
Principle of least privilege
Move across only the CAs that are required for your EST use case. Limiting the number of exposed CAs reduces the attack surface and simplifies certificate management.
Sending for Approval¶
Click SEND FOR APPROVAL to submit the selection. This does not apply the configuration directly: it creates an EST service configuration request that has to be approved before it takes effect. On success the GUI confirms that the request was sent and returns to the configuration list, where the new request appears with its current state.
CANCEL returns to the list without creating a request.
SEND FOR APPROVAL is disabled until something changes
The button is unselectable while the page is loading, and while the Selected column still matches the configuration in effect — a request that changes nothing has nothing to approve. It becomes selectable as soon as you add a CA or withdraw one, and goes back to unselectable if you undo the change. Withdrawing every CA counts as a change, so an empty configuration can be submitted deliberately.
Approval¶
An EST service configuration request has to be approved before the EST endpoint reflects it. Approvers open Approvals → Est Service, which lists the requests waiting for a decision.
- Select a request with the radio button in the first column.
- Choose Approve or Reject. Both ask for confirmation before the decision is sent.
The approvals list identifies each request by its id only. To see which CAs a request contains, open it from the configuration list — see Viewing a Configuration.
Viewing a Configuration¶
Admin → Est Service lists the EST service configuration requests, showing the id and the state of each. The row action menu offers View Configuration Details, which opens a read-only view of one request:
| Field | Description |
|---|---|
| Id | The identifier of the configuration request. |
| State | Where the request stands — created, awaiting approval, approved, ready, rejected or failed. |
| Configured CAs | The CAs the request contains, listed by CA name. |
Troubleshooting¶
| Issue | Possible Cause | Resolution |
|---|---|---|
| No CAs appear in the Available list | No product has a CA whose use case is Device CA or GenUse0 | Add a Device CA or a GenUse0 CA to the relevant product in the Products section |
| A product's CAs are missing from the list | The product's CAs have not been provisioned yet, or they use a use case that EST does not accept | Complete the PKI setup for the product, and check the CA use case against the rules under Available CAs |
| The same product appears on several rows | Expected: the product has more than one eligible CA | Each row is one CA — check the CA name to tell them apart |
| EST clients cannot enroll after sending the request | The request has not been approved yet, or the client lacks valid credentials | Check the request state in Admin → Est Service, and verify the EST client's credentials |
| A CA that used to work stopped issuing after a new configuration was approved | The approved request replaced the configuration and did not include that CA | Create a new request whose Selected column holds every CA the EST service should publish, including the ones already in use |