System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Trust anchor databases and their uses in the EST protocol

Updated: September 18, 2026

Want to summarize with AI?

Describes the trust anchor databases used to validate EST server and client certificates during enrollment and re-enrollment.

Use this topic to identify the trust anchor databases used during EST authentication.

A trust anchor (TA) database is a repository of trusted anchor certificates used to verify the authenticity of a Certification Authority (CA) during certificate enrollment. Use this table to identify each TA database and its purpose.

Table 1. Trust anchor databases and their uses
If the TA database type is...	Then it is used by ...	For the purpose of...
EST server	EST server	authenticating certificates issued by the EST CA during enroll and re-enroll operations.
EST server (implicit)	EST server	authenticating certificates issued by the EST CA; can be disabled if not needed.
EST client	EST client	authenticating EST server certificates issued by the EST CA.
EST client (implicit)	EST client	authenticating an EST server using an externally issued certificate; can be disabled if unnecessary.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.