PKI --EST(1)                      strongSwan                      PKI --EST(1)

<?><?><?> (NAME)
       pki --est - <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> X.509
       <?><?><?> <?><?> <?><?><?><?> EST

<?><?><?><?><?> <?><?><?><?><?> (SYNOPSIS)
       pki --est ---url url [--label label] [--in file] --cacert file [--cert
                 file|--certid hex --key file|--keyid hex]
                 [--userpass username:password] [--interval time]
                 [--maxpolltime time] [--outform encoding] [--debug level]

       pki --est --options file

       pki --est -h | --help

<?><?><?><?><?><?><?> (DESCRIPTION)
       <?><?><?> <?><?><?><?><?><?><?><?> <?><?> pki(1) <?><?>
       <?><?><?><?><?><?><?> <?><?><?><?><?> PKCS#10 <?><?> <?><?>
       <?><?><?><?> HTTPS <?><?> <?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?><?> Enrollment over Secure Transport (EST) (RFC 7030)
       <?><?> <?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?>. <?><?>
       <?><?> <?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?> <?><?> <?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?><?> (polling) <?><?> <?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?> EST
       <?><?> <?><?><?><?><?> X.509 <?><?><?><?><?><?><?> <?><?><?><?> CA
       <?><?> <?><?><?><?><?><?><?><?><?><?><?><?>.

       <?><?><?> <?><?> <?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?> <?><?> <?><?> <?><?><?><?> <?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> <?><?>
       <?><?> <?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?> <?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?><?> TLS <?><?><?> <?><?><?><?> EST
       <?><?><?><?><?><?><?> <?><?><?><?><?><?>.

<?><?><?><?><?><?><?><?> (OPTIONS)
       -h, --help
              <?><?><?> <?><?><?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?>
              <?><?><?><?><?>.

       -v, --debug level
              <?><?><?><?><?> <?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?>
              <?><?><?><?><?><?><?>: 1.

       -+, --options file
              <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?> <?><?>
              <?><?><?><?><?> <?><?> file.

       -u, --url url
              <?><?><?><?><?> URL <?><?><?><?> EST.

       -l, --label label
              <?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?> EST.

       -i, --in file
              <?><?><?><?><?><?><?> <?><?><?><?><?> PKCS#10. <?><?><?>
              <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>
              <?><?><?><?><?> <?><?> STDIN <?><?><?><?><?><?>
              <?><?><?><?><?><?>.

       -C, --cacert file
              <?><?><?><?><?> CA <?><?> <?><?><?><?><?><?> <?><?><?><?><?><?>
              <?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?>
              TLS <?><?> EST <?><?> <?><?> <?><?><?><?><?><?>
              <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> CA
              <?><?><?><?><?><?><?> <?><?><?><?><?><?>.
              <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?>
              <?><?><?><?><?><?><?> <?><?><?>.

       -c, --cert file
              <?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>.

       -X, --certid hex
              <?><?><?><?><?> <?><?><?> (handle) <?><?><?><?><?>
              <?><?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?> <?><?>
              TPM 2.0.

       -k, --key file
              <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?><?><?>.

       -x, --keyid hex
              <?><?><?><?><?> <?><?><?> (handle) <?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?> <?><?>
              TPM 2.0.

       -p, --userpass username:password
              <?><?><?><?><?> <?><?><?><?><?><?><?> username:password <?><?>
              <?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?>
              <?><?><?><?> HTTP <?><?><?><?><?><?><?> <?><?><?>.

       -t, --interval time
              <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?> (poll) <?><?> <?><?><?><?><?><?>
              <?><?><?><?><?><?><?> 60s <?><?><?>. <?><?><?> <?><?><?><?><?>
              <?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?><?><?>
              retry-after <?><?> <?><?><?><?> HTTP 202 <?><?> <?><?><?><?> EST
              <?><?><?><?><?><?><?><?> <?><?><?>.

       -m, --maxpolltime time
              <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?> (poll) <?><?> <?><?><?><?><?><?>
              <?><?><?><?><?><?><?> 0 <?><?><?> <?><?> <?><?> <?><?><?><?>
              <?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?><?>
              <?><?><?><?><?><?><?>.

       -f, --outform encoding
              <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?><?>. <?><?> der (ASN.1 DER) <?><?> pem
              (Base64 PEM)<?> <?><?><?><?><?><?><?> der <?><?><?>.

<?><?><?><?><?><?><?> (EXAMPLES)
       <?><?><?><?> <?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?> <?><?>
       <?><?> <?><?><?><?> est.opt <?><?><?><?><?> <?><?><?><?><?><?><?>:

       --url https://pki.strongswan.org:8443
       --cacert tlsca.crt
       --cacert tlsca-1.crt
       --cacert myca.crt
       --cacert myca-1.crt

       <?><?><?><?>: <?><?><?><?> <?><?> <?><?><?><?><?> HTTPS <?><?><?><?><?>
       <?><?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> EST
       <?><?><?><?><?><?> <?><?><?>. <?><?><?><?><?><?> <?><?><?><?><?><?> TLS
       <?><?><?><?> <?><?><?><?><?> CA <?><?><?><?> <?> <?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?><?><?><?> CA <?><?><?><?><?>
       <?><?><?><?> <?><?> <?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?><?><?><?><?> <?><?><?><?><?> --cacert <?><?><?><?>
       <?><?><?>.

       <?><?><?><?><?> --cacert <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?>
       CA <?><?><?><?> <?><?><?> <?><?><?> <?><?><?><?><?><?><?> <?><?><?>.
       <?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?> <?><?><?><?>
       <?><?><?> <?><?> <?><?><?><?><?><?> <?><?><?><?><?><?> TLS
       <?><?><?><?><?> <?><?><?><?> (<?><?><?> <?><?><?><?> EST <?><?>
       <?><?><?><?><?> <?><?><?><?> TLS <?><?><?><?><?><?><?> <?><?><?><?> CA
       <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?>) <?><?> <?><?><?><?>
       <?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?> <?><?><?><?><?> <?><?><?> <?><?><?><?><?> <?><?><?><?> EST
       <?><?> Let's Encrypt <?><?><?><?><?><?><?> <?><?><?> <?><?><?><?>.

       <?><?> <?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?> X.509
       <?><?><?><?><?><?><?> <?><?><?><?> CA <?><?><?><?><?> <?><?>
       <?><?><?><?> <?><?> <?><?><?><?><?><?><?> <?><?><?><?><?> PKCS#10
       <?><?> <?><?> <?><?><?><?> EST <?><?><?><?><?><?><?>
       <?><?><?><?><?><?>:

       pki --options est.opt --in moonReq.der > moonCert.der

       negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384
       received TLS server certificate 'C=CH, O=strongSwan Project, CN=pki.strongswan.org'
         using certificate "C=CH, O=strongSwan Project, CN=pki.strongswan.org"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
         EST request pending, polling indefinitely every 300 seconds
         going to sleep for 300 seconds
         ...
       Issued certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         serial: 1a:ff:de:66:d9:38:ea:d5:b6:da
         using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
       Issued certificate is trusted, valid from Aug 22 15:19:43 2022 until Aug 22 15:19:43 2023 (currently valid)

       <?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?><?><?> <?><?><?><?>
       <?><?><?> <?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?>
       <?><?><?><?><?> <?><?><?>:

       pki --options est.opt --in moonReqNew.der --cert moonCert.der --key moonKey.der > moonCertNew.der

       negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384
       received TLS server certificate 'C=CH, O=strongSwan Project, CN=pki.strongswan.org'
         using certificate "C=CH, O=strongSwan Project, CN=pki.strongswan.org"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
       sending TLS client certificate 'C=CH, O=strongSwan Project, CN=moon.strongswan.org'
       sending TLS intermediate certificate 'C=CH, O=strongSwan Project, CN=strongSwan Issuing CA'
       Issued certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         serial: 1b:ff:ad:dc:2f:50:c4:cb:a1:44
         using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
       Issued certificate is trusted, valid from Jul 20 12:21:00 2023 until Jul 20 12:21:00 2024 (currently valid)

       <?><?><?> <?><?><?><?> <?><?><?><?><?> <?> <?><?><?><?><?>
       <?><?><?><?><?><?> <?><?> <?><?> TPM 2.0 <?><?><?><?><?> <?><?><?>
       <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?><?><?><?><?> <?><?><?> <?><?><?><?><?> <?><?><?>:

       pki --options est.opt --in moonReqNew.der --certid 0x01800004 --keyid 0x81010004 > moonCertNew.der


<?><?><?><?><?><?> <?><?><?><?><?><?> (SEE ALSO)
       pki(1)

6.1.0                             2022-08-22                      PKI --EST(1)