System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

EST protocol for automated certificate provisioning

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how Enrollment over Secure Transport uses TLS to secure certificate provisioning and automate certificate renewal for configured trustpoints.

Enrollment over Secure Transport (EST) is a digital certificate provisioning protocol that

  • uses TLS to secure certificate provisioning communication

  • supports designated certificate requestors, and

  • automates certificate renewal.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

EST protocol for automated certificate provisioning

Release 26.1.1

Introduced in this release on: Centralized Systems (8400 [ASIC: K100])(select variants only*)

* This feature is now supported on Cisco 8404-SYS-D routers.

EST protocol for automated certificate provisioning

Release 25.1.1

Introduced in this release on:

Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100])

This release introduces support for Enrollment Over Secure Transport (EST), a digital certificate provisioning protocol, which enhances certificate management by offering secure transport using TLS and designated certificate requestors. It enables automated certificate renewal.

EST is an enhancement of the existing Simple Certificate Enrollment Protocol (SCEP), providing improved security and flexibility for certificate management operations over both IPv4 and IPv6 networks.

The feature introduces these changes:

CLI:

YANG Data Model:

  • Cisco-IOS-XR-crypto-cepki-cfg

  • Cisco-IOS-XR-um-crypto-cfg

(see GitHub, YANG Data Models Navigator)

EST protocol features and benefits

Use this topic to understand the security and automation benefits provided by EST.

EST provides these key features and benefits:

  • Secure transport: EST uses TLS to secure messages and certificates without additional encapsulation.

  • Designated certificate requestors: EST associates a certificate signing request (CSR) with a specific trusted requestor authenticated with TLS.

  • Automated certificate renewal: EST supports automatic re-enrollment for seamless certificate renewal.

EST protocol components and terminology

Identify the components and terms used in the EST protocol.

These terms describe components related to the EST protocol:

  • Certificate Management Protocol (CMP): A protocol with comprehensive capabilities for managing digital certificates, including enrollment, renewal, and revocation.

  • Certificate signing request (CSR): A message that the client sends to the CA to request a digital certificate. The CSR includes the client public key and identifying information.

  • PKCS 7: A standard for cryptographic message syntax that SCEP uses to encapsulate messages.

  • Public Key Infrastructure (PKI): The framework that manages digital certificates and keys for certificate provisioning operations through EST.

  • Simple Certificate Enrollment Protocol (SCEP): An older certificate provisioning protocol that relies on HTTP and PKCS 7 to secure messages and does not provide some of the modern security features of EST.

EST client authentication options

Use this topic to understand the authentication options available to an EST client.

EST supports these client authentication options:

  • TLS certificate-based authentication uses a valid certificate chain signed by a CA in the EST server trust store. The server verifies the client during mutual TLS (mTLS) authentication. The bootstrap certificate is used for first enrollment, and the certificate issued during initial enrollment is used for re-enrollment.

  • HTTP-based authentication establishes a TLS session and sends HTTP authentication credentials when a bootstrap certificate is unavailable. Type 6 encryption protects passwords configured on the router. Type 6 encryption is disabled by default and must be enabled manually. A master key must also be created and stored in the Trust Anchor Module (TAM).

For HTTP-based authentication, the client sends a username and clear-text password through the TLS-encrypted channel. The device validates the EST server by using the server certificate CA or subordinate CA chain installed locally.