Enrollment with PKI

Enrollment with PKI covers the path from device admission to identity installation and renewal. The DMS acts as a registration authority: it authenticates the request, applies registration policy and asks the CA to sign. The client keeps or receives the key, installs the result and presents it to the consumer.

The journey

The administrator prepares the CA, issuance profile and DMS.
The integrator installs initial EST server trust and an admission credential.
The client requests an identity for its Device ID through EST.
Certificate, device binding and key/certificate installation are checked.
The consumer validates and authorizes the identity; the client schedules renewal and recovery.

EST uses /.well-known/est/{DMS_ID}. Administrative APIs and manual assignment remain separate paths. Enroll and connect a device completes an initial mTLS test.

For the administrator

Provisioning strategies

Choose automatic registration, preregistration or manual assignment.

Configure the DMS

Separate admission, authentication per operation, profiles and distribution.

Bootstrap identity and authentication

Decide which proof allows requesting the first identity.

Trust distribution

Update roots and chains with verified overlap.

For the integrator

EST client

Prepare the request, verify the response and install the identity.

Renewal and recovery

Generate the successor and handle expired or lost credentials.

EST reference

Look up paths, formats, authentication and ServerKeyGen.

Troubleshooting

Distinguish transport, policy, issuance and installation failures.

Contract version

This block describes main code inspected at commit 8f42c47157f9a36bac3ed5caa3692aebebe19c4b. The site catalog publishes main (unstable); this behavior is not attributed to a stable release. Before using another version, check its contract and migrations, particularly independent re-enrollment authentication. Client checks and live-instance tests are distinguished in the revision plan.

Gateway, TLS, provider and service configuration belongs to Deployment. Identity use in AWS or other destinations belongs to Integrations.