estclient(1)

💖 estclient — the manual page, but make it a group chat 💖

okay bestie, so this is estclient(1), living under the libEST Documentation umbrella. It's the example EST client application that uses the granular API — basically a lil demo client showing off everything the EST library can do, one flag at a time. Pull up a chair, grab a boba, we're going through every single option together and I'm not skipping a one. 🫶

---

✨ NAME ✨

estclient — example EST client application using the granular API

---

🌸 OPTIONS 🌸

• -v — verbose operation, aka make it yap. 🗣️
• -g — get the CA certificate from the EST server. Just the CA cert, nothing extra. 🎀
• -e — enroll with the EST server and request a cert.
• -q — enroll with the EST server and request a cert plus a private key generated server-side. Yes, the server makes the key. Not us. 🫣
• -a — get CSR attributes from the EST server.
• -z — force binding the PoP by including the challengePassword in the CSR. proof-of-possession said periodt. 💅
• -r — re-enroll with the EST server and request a cert. must use the -c option, no exceptions bestie.
• -c certfile — identity certificate to use for the TLS session.
• -k keyfile — use together with -c to specify the private key for that identity cert. they're a package deal. 👯
• -x keyfile — use an existing private key from the given file for signing the CSR.
• -y csrfile — use an existing CSR from the given file.
• -s server — enrollment server IP address.
• -p port — TCP port number for the enrollment server.
• -o dir — directory where the pkcs7 certs will be written. 📁
• -i count — number of enrollments to perform per thread (default = 1).
• -w count — timeout in seconds to wait for the server response (default = 10). she waits, but only so long. ⏳
• -f — runs EST Client in FIPS MODE = ON. 🔐
• -u string — specify the user name for HTTP authentication.
• -h string — specify the password for HTTP authentication.
• -? — print this help message and exit. classic. 🚪
• --keypass_stdin — specify en-/decryption of the private key, with the password read from STDIN.
• --keypass_arg — specify en-/decryption of the private key, with the password read from the argument.
• --common-name string — specify the common name to use in the Subject Name field of the new certificate. 127.0.0.1 will be used if this option isn't specified. 🏠
• --pem-output — convert the new certificate to PEM format.
• --srp — enable TLS-SRP cipher suites. Use it with the --srp-user and --srp-password options, they're a trio, don't split them up. ✨
• --srp-user string — specify the SRP user name.
• --srp-password string — specify the SRP password.
• --auth-token string — specify the token to be used with HTTP token authentication.
• --path-seg string — specify the optional path segment to use in the URI.
• --proxy-server string — proxy server to enable SOCK/HTTP proxy mode.
• --proxy-port port — proxy port number. must include proxy-server — no orphan ports in this house. 🚫
• --proxy-proto EST_CLIENT_PROXY_PROTO — proxy protocol.
• --proxy-auth BASIC|NTLM — proxy authentication method.
• --proxy-username string — username to pass to the proxy server.
• --proxy-password string — password to pass to the proxy server.

---

📜 COPYRIGHT & LICENSE 📜

Copyright (c) 2012-2018 Cisco Systems, Inc. All rights reserved.

License (BSD-3-Clause), and yes we're keeping every word because legal text does not get the vibe treatment, bestie, it gets the verbatim treatment:

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
Redistributions of source code must retain the above copyright
  notice, this list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above
  copyright notice, this list of conditions and the following
  disclaimer in the documentation and/or other materials provided
  with the distribution.
Neither the name of the Cisco Systems, Inc. nor the names of its
  contributors may be used to endorse or promote products derived
  from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.

---

👑 AUTHOR 👑

This manpage is based on estclient's usage output and the included documentation. It was written for the Debian project by Christoph Biedl <debian.axhn@manchmal.in-ulm.de> but may be used by others. iconic of him honestly. 💜

---

and that's the whole page, bestie!! 💅 this one came from <b>libEST 3.2.0</b> and it's dated <b>2024-07-28</b> — so if you're reading this and the version on your box says something else, that's the vibe check telling you to go re-read the fresh one. mwah, love u, go get those certs. 🎀✨🦋