Skip to main content

Documentation Index

Fetch the complete documentation index at: https://infisical.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

New to Certificate Manager? Start with Issue Your First Certificate.
Use the EST enrollment method to issue and renew certificates for enterprise devices, IoT systems, and secure networks. EST provides strong mutual TLS authentication and is ideal for environments where devices have pre-installed bootstrap certificates.
EST enrollment is configured on profiles attached to your Application. Product Admins attach profiles, and Application Admins configure enrollment methods on those profiles.

​
When to Use EST Enrollment

Enterprise Devices

Managed corporate laptops, workstations, and mobile devices.

IoT Devices

Industrial equipment, sensors, and embedded systems with factory certificates.

Network Infrastructure

Switches, routers, and other network equipment with 802.1X authentication.

Secure Environments

Environments requiring mutual TLS authentication for certificate requests.
Infisical’s EST service implements RFC 7030 with the following endpoints:
EndpointPurpose
/cacertsGet the CA chain for certificate validation
/simpleenrollRequest a new certificate
/simplereenrollRenew an existing certificate

​
Prerequisites

1

Bootstrap certificates

Your devices need a pre-installed bootstrap certificate (factory/manufacturer certificate) for initial authentication.
If your devices don’t have bootstrap certificates, you can disable bootstrap validation in the EST configuration (less secure).
2

Trust Infisical's EST server

Devices must trust the TLS certificates used by Infisical’s EST server.
For Infisical Cloud, configure devices to trust Amazon root CA certificates.

​
Configure EST Enrollment

1

Navigate to your Application

Go to Certificate Manager → Applications and select your Application.
2

Configure enrollment on an attached profile

Go to the Settings tab and find the Certificate Profiles section. Click Configure on the profile you want to enable EST enrollment for.
Profiles are attached by Product Admins. If you don’t see any profiles, ask your Product Admin to attach one.
3

Add EST enrollment

In the modal, click Add enrollment method and select EST.
4

Configure EST settings

SettingDescription
EST PassphrasePassword for client authentication (used as EST password on devices)
CA Chain CertificateCertificate chain to validate device bootstrap certificates
Disable Bootstrap ValidationSkip bootstrap certificate validation (for devices without factory certs)
Disabling bootstrap validation removes a layer of security. Only use this for testing or controlled environments.
5

Get EST endpoints

After saving, Infisical provides EST endpoint URLs that you can view in the enrollment configuration. The endpoints follow the EST standard paths:
  • /cacerts — retrieve CA certificates
  • /simpleenroll — initial enrollment
  • /simplereenroll — certificate renewal
The EST endpoint URL is unique to this Application + Profile pair. Certificates requested through these endpoints are associated with this Application and follow the selected profile’s policy. EST endpoints use port 8443 and the .well-known/est path as defined in RFC 7030.

​
Enroll a Device

Configure your EST client with the profile ID and passphrase.
For new devices with a bootstrap certificate:
  1. Configure the EST server URL: https://app.infisical.com:8443/.well-known/est/{profile-id}
  2. Set EST username to any value (e.g., device-001)
  3. Set EST password to your EST Passphrase
  4. Use the bootstrap/manufacturer certificate for client authentication
  5. Generate a CSR and call /simpleenroll
# Example using curl (simplified)
curl --cert bootstrap-cert.pem --key bootstrap-key.pem \
  -u "device-001:<EST-passphrase>" \
  --data-binary @device.csr \
  -H "Content-Type: application/pkcs10" \
  "https://app.infisical.com:8443/.well-known/est/{profile-id}/simpleenroll"
When creating PKCS#12 bundles for client certificates, include only the leaf certificate and private key (not the full chain).

​
What’s Next?

SCEP Enrollment

Use SCEP for network devices and MDM systems.

Certificate Syncs

Push certificates to cloud destinations.

Alerting

Get notified when certificates are about to expire.

Managing Certificates

View and manage certificates in your Application.