MTG EST Server
Introduction
This page describes the basic functions of the MTG EST Server, an implementation of an EST server according to [RFC7030]. It integrates with MTG-CLM.
MTG-CLM integration
To enable integration with MTG-CLM, the MTG EST Server uses the credentials of an API client as described in [MTG_EST_Administration_Manual]. Additionally, the MTG EST Server uses a policy to handle certificate management (policies in MTG-CLM are recipes for how certificates are created). It identifies the CA that will issue the certificate, the template that will be used and can also contain additional restrictions and configurations for the certificate lifecycle.
Defining default policy
API clients are optionally associated with a default policy. The MTG EST Server uses, by default, the default policy of the associated API client to handle certificate management. In case the API client is not associated with a default policy and the client does not specify a different policy in the request (see Different policies endpoints), the MTG EST Server will respond with an invalid identifier error.
Defining different policy
The MTG EST Server supports specifying a different policy as the policy to be used instead of the API client’s default policy. The new policy’s ID has to be used in the requests towards EST server as described in Different policies endpoints.
Set up password login
The MTG EST Server supports basic authentication (see [RFC7617]). The credentials for this type of authentication can be obtained by creating an end entity and an associated end entity password. More details can be found in End Entities Password. Configure the end entity ID of the end entity in username and the end entity password in password to execute basic authentication requests.
Custom features
Different policies endpoints
Per default the MTG EST Server offers the following endpoints:
-
EST_SERVER_BASE_URL/.well-known/est/cacerts -
EST_SERVER_BASE_URL/.well-known/est/simpleenroll -
EST_SERVER_BASE_URL/.well-known/est/simplereenroll
Client requests to these endpoints use the default policy.
The MTG EST Server provides supplementary endpoints to support requests that require a different policy. Requests towards these endpoints specify a different policy to use, rather than the default policy of the associated API client. These are the endpoints for the different policy endpoints:
-
EST_SERVER_BASE_URL/.well-known/est/<identifier>/cacerts -
EST_SERVER_BASE_URL/.well-known/est/<identifier>/simpleenroll -
EST_SERVER_BASE_URL/.well-known/est/<identifier>/simplereenroll
The <identifier> needs to be replaced with a valid policy ID.
For example to request a certificate that is issued under the policy
ffc0d281-f9df-45cd-a30d-1881cd67012a use the URL:
EST_SERVER_BASE_URL/.well-known/est/ffc0d281-f9df-45cd-a30d-1881cd67012a/simplereenroll.