{"id":16929020,"url":"https://github.com/hslatman/caddy-est","last_synced_at":"2025-03-21T02:44:15.063Z","repository":{"id":72403403,"uuid":"331754467","full_name":"hslatman/caddy-est","owner":"hslatman","description":"A Caddy module for issuing certificates using Enrollment over Secure Transport (EST, RFC7030)","archived":false,"fork":false,"pushed_at":"2021-01-24T17:11:31.000Z","size":7225,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-01-25T23:34:10.693Z","etag":null,"topics":["caddy","est","pki","rfc7030"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hslatman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-01-21T21:03:50.000Z","updated_at":"2024-01-28T07:58:20.000Z","dependencies_parsed_at":"2023-02-24T08:30:19.563Z","dependency_job_id":null,"html_url":"https://github.com/hslatman/caddy-est","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hslatman%2Fcaddy-est","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hslatman%2Fcaddy-est/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hslatman%2Fcaddy-est/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hslatman%2Fcaddy-est/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hslatman","download_url":"https://codeload.github.com/hslatman/caddy-est/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244728196,"owners_count":20500023,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["caddy","est","pki","rfc7030"],"created_at":"2024-10-13T20:38:16.462Z","updated_at":"2025-03-21T02:44:15.044Z","avatar_url":"https://github.com/hslatman.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# caddy-est\n\nA [Caddy](https://caddyserver.com/) module for issuing certificates using Enrollment over Secure Transport (EST, [RFC7030](https://tools.ietf.org/html/rfc7030)).\n\n## Description\n\nThis is a POC Caddy module implementation for issuing certificates using the Enrollment over Secure Transport [(EST)](https://tools.ietf.org/html/rfc7030) protocol.\nEST can be used to (automatically) issue certificates to devices and end users and can be seen as a successor to [SCEP](https://tools.ietf.org/html/rfc8894).\nIts goal is similar as the [ACME](https://tools.ietf.org/html/rfc8555) protocol, which is used for Web PKI, but is applied to devices that are generally not available publicly on the web and can thus not perform the active challenge-response protocol that ACME uses. \n\nThis module uses [globalsign/est](https://github.com/globalsign/est) for providing the EST functionality. \nCaddy is the host for the endpoints served by the `est` library and also provides PKI maintenance functionality. \nWe provide Caddy with the configuration for the `pki` app, which results in Caddy controlling the CA that is used for issueing certificates.\nIt is thus advisable to create a `ca` configuration for the `pki` app that is used specifically for the EST module.\nAn example configuration is available in `config.json`.\n\n__Please note that the module currently does not provide much in terms of initial authentication except for a rudimentary HTTP Basic Authentication implementation. Mutual TLS can be used, but requires an EST client implementation that supports it.__\n\n## Usage\n\nThe simplest way to use the EST module is by using [xcaddy](https://github.com/caddyserver/xcaddy) to build your custom Caddy instance:\n\n```bash\n$ xcaddy build v2.3.0 --with github.com/hslatman/caddy-est/pkg/est\n```\n\nAlternatively, the HTTP handler can be included as a Caddy module as follows:\n\n```golang\nimport (\n\t_ \"github.com/hslatman/caddy-est/pkg/est\"\n)\n```\n\nBelow is an excerpt of the configuration for (just) the EST module:\n\n```json\n...\n    \"handle\": [\n        {\n            \"handler\": \"est\",\n            \"ca\": \"est-example\",\n            \"allowed_hosts\": [\n                \"estserver.local.example.com\"\n            ],\n            \"rate_limit\": 0,\n            \"enable_basic_auth\": false,\n            \"basic_auth_username\": \"username\",\n            \"basic_auth_password\": \"password\",\n            \"sign_with_root\": false\n        }\n    ]\n...\n```\n\nThe EST handler expects a Caddy PKI instance to be available called `est-example`, which you'll have to configure manually.\nA more complete configuration, including examples for the PKI, TLS and HTTP is available in `config.json`.\n\n## Out of Scope\n\n* Certificate-less TLS.\n* ...\n\n## Caveats\n\n* Client authentication using an existing certificate does not seem to be working fully as expected yet. \nThis may be due to the `globalsign/est` client implementation, but I'm not fully sure yet. \nWe can try the `thales-e-security/estclient` instead to see if that one works with the previously issued certificate. \n\n## Things That Can Be Done\n\n* Add tests.\n* Add auditing of (re)enrollments (e.g. log, store, others); storage could work similar as the `acmeserver` handler.\n* Add example with user provided public/private key pair.\n* Add example usage of client cert authenticating to (different) Caddy server.\n* Implement CSR attributes\n* Authenticate client in a different way (currently using a fixed HTTP Basic Auth) during initial enrollment. \nThis needs something like a list of users (IDs) + passwords, a more generic approach to authentication (i.e. Caddy auth, but that's not in the RFC) or the shared secret approach (although a single shared secret is also not nice ...). \nSomething like a single use token retrieved in some out-of-band way and sent in a HTTP header is probably what we want, although that wouldn't be entirely according to the RFC.\n* ~~Test HTTP Basic Authentication with an EST client that supports it.~~ The `globalsign/est` client seems to work just fine.\n* Test Mutual TLS for enrollment. Currently this is only partially supported, because the `globalsign/est` server does not seem to handle this fully itself, but it can be implemented at the server level. Requires EST clients that support Mutual TLS though.\n* Add (automated) tests and examples with EST client libraries.\n* Have a look at the [Extensions](https://tools.ietf.org/html/rfc8295) for EST?\n* Implement ServerKeyGen and TPMEnroll?\n* Work with actual TPM/HSM? Also see this [commit](https://github.com/globalsign/est/commit/4f0fac33feb82749209342878df1608691ff991c).\n* Refactor into using our own endpoints instead of going through the Chi router provided by `globalsign/est`.\n* ...\n\n...","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhslatman%2Fcaddy-est","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhslatman%2Fcaddy-est","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhslatman%2Fcaddy-est/lists"}