estserver(1)

📦
version 3.2.0 · 2 versions
, in debian trixie, ubuntu resolute

✨ estserver — like, the whole vibe ✨

okay so bestie, welcome to estserver(1) from the libEST Documentation 💖 this is the example EST server application using OpenSSL CA — a lil demo server that shows off what EST can do, and honestly? iconic. 👑

It's got a lot of flags. Like, a lot a lot. But don't panic — we're going through every single one together, no skips, no cap. 🫶

🌸 OPTIONS 🌸

  • -v — verbose operation. she talks more. u get to see what's going on. 👀
  • -c file — the PEM file to use for the server cert. 🎀
  • -k file — the PEM file to use for the server key. 🔑
  • -r value — the HTTP realm to present to clients. heads up: max is 32 characters. keep it short, bestie. ✂️
  • -l — enable CRL checks. 🔍
  • -t — enable the check for binding client PoP to the TLS UID. 💅
  • -m seconds — simulate manual CA enrollment. like, pretend-mode. 🎭
  • -n — disable HTTP authentication. (TLS client auth is required in that case, so don't skip it.) 🚫
  • -o — disable HTTP authentication when TLS client auth succeeds. 🎉
  • -h — use HTTP Digest auth instead of Basic auth. 🍵
  • -b — use HTTP Basic auth. This causes an explicit call to set Basic auth. ⚡
  • -p num — TCP port number to listen on. pick ur fave. 🔢
  • -d seconds — sleep timer to auto-shut the server. she naps and then dips. 😴
  • -f — runs the EST Server in FIPS MODE = ON. 🔒
  • -6 — enable IPv6. ✨
  • -w — dump the CSR to /tmp/csr.p10, allowing for manual attribute capture on the server. yes, that exact path. 💾
  • -? — print this help message and exit. the classic "help me" move. 🙋
  • --keypass_stdin — specify en-/decryption of private key, password read from STDIN. ⌨️
  • --keypass_arg — specify en-/decryption of private key, password read from the argument. 📝
  • --srp file — enable TLS-SRP authentication of the client using the specified SRP parameters file. 🛡️
  • --enforce-csr — enable CSR attributes enforcement. The client must provide all the attributes in the CSR. no partial credit, fr fr. 📋
  • --token value — use HTTP Bearer Token auth. 🎫
  • --enhcd_cert_auth — enable Enhanced Certificate Auth mode. 👑
  • --enhcd_cert_local_nid nid — sets the local PKI domain subject field NID to grab from the peer cert. If not set, the commonName NID will be used. 🪪
  • --cert_auth_ah_pwd value — specify the auth header password to use in Enhanced Certificate Auth mode. 🤫
  • --cert_auth_csr_check_on — enable the CSR check during Enhanced Cert Auth. ✅
  • --enhcd_cert_mfg_name name — sets the name of the manufacturer to be registered. This name is required when registering a manufacturer. 🏭
  • --enhcd_cert_mfg_truststore file — specifies a truststore file for an Enhanced Certificate Auth manufacturer to select the subject field based upon. This truststore is required when registering a manufacturer. 📁
  • --enhcd_cert_mfg_nid nid — sets the subject field NID to grab from the peer cert when that cert came from the manufacturer. If not set, the commonName NID will be used. 🔎
  • --enable-brski — enable BRSKI bootstrapping support. 🚀
  • --perf-timers-on — enable the performance timers in server. ⏱️

Copyright (c) 2012-2018 Cisco Systems, Inc. All rights reserved.

License (BSD-3-Clause):

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
Redistributions of source code must retain the above copyright
  notice, this list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above
  copyright notice, this list of conditions and the following
  disclaimer in the documentation and/or other materials provided
  with the distribution.
Neither the name of the Cisco Systems, Inc. nor the names of its
  contributors may be used to endorse or promote products derived
  from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.

🦋 AUTHOR 🦋

This manpage is based on estserver's usage output and the included documentation. It was written for the Debian project by Christoph Biedl <debian.axhn@manchmal.in-ulm.de> but may be used by others. 🫶

and that's the whole page, bestie!! 💅 this one's libEST 3.2.0, dated 2024-07-28 — go forth and serve some certs, u absolute main character. 👑🌸✨

📦 where this page comes from