Skip to content

go-pki-est

GitHub Release Go Reference License Tests Supply chain OpenSSF Scorecard

go-pki-est is a Go library for Enrollment over Secure Transport (EST), the certificate enrollment protocol of RFC 7030. It contains:

  • an EST client for Go programs, est.Client
  • an EST server as an http.Handler in front of your CA, built by est.NewRouter from your implementation of the CA interface
  • estclient, a command line client built on the library
  • estserver, a test server with a mock CA for development

Clients sign in with TLS client certificates, HTTP Basic, bearer tokens or TLS-SRP passwords. Certificates can carry post-quantum ML-DSA keys. The support matrix lists what is covered.

Install

go get github.com/misiektoja/go-pki-est

The module needs Go 1.27.3 or newer. The package is imported as est. The command line tools install with:

go install github.com/misiektoja/go-pki-est/cmd/estclient@latest

go install github.com/misiektoja/go-pki-est/cmd/estserver@latest

Start here

Getting started starts estserver, enrolls and renews with estclient and then does the same from Go.

Where to go next

I want to Page
Know which operations, algorithms and peers are covered Support matrix
Understand how the client, the router and my CA fit together Architecture
Enroll, renew or get a server-generated key from Go Enrollment and renewal
Sign in with a certificate, a password, a token or TLS-SRP Signing in
Use a proxy, trace requests or raise limits Connections and hooks
Serve EST in front of my CA Embedding the server and The CA interface
Decide who may enroll and renew Server authentication
Use ML-DSA, SLH-DSA, composite ML-DSA or ML-KEM keys Post-quantum algorithms
Look up a command line flag or configuration key estclient and estserver
Look up a field Client fields and ServerConfig fields
Fix something that does not work Troubleshooting
See which servers the client was tested with Interoperability
Understand what is not implemented Known limitations
Check a downloaded release Verifying a release
Look up a type or function Package documentation
See what changed in a release Changelog
Ask for help or report a problem Support

Design and security

  • Security model - what the library checks and what remains with the host
  • Errors - the statuses and messages the server sends and how the client reports them
  • Compatibility policy - what may change between releases

Contributing

Credits

This project began as a fork of globalsign/est by GMO GlobalSign. The protocol implementation, both command line tools and the test server come from that project. The first fixes made here were offered upstream in globalsign/est#59 to globalsign/est#66. This fork is maintained separately so fixes and new features ship in its own releases. Changes that suit upstream are still offered there. NOTICE records the attribution.

Other PKI projects from the same maintainer:

  • certrally: a command line client for certificate enrollment over CMP, EST and SCEP
  • cmp-issuer: a cert-manager external issuer for CMP servers
  • go-acme-server: an embeddable ACME server library for Go (RFC 8555)
  • go-pki-cmp: a Go library for the Certificate Management Protocol (CMP) with a client and a server
  • go-pki-scep: a Go library for SCEP (RFC 8894) with a client and a server handler
  • go-pkcs7: a Go library for PKCS #7 and CMS (RFC 5652) signed and enveloped data
  • go-composite-mldsa: a Go library for post-quantum composite ML-DSA signatures
  • go-tls-srp: TLS 1.2 with SRP password authentication (RFC 5054) for Go