STRONGSWAN_PKI---ESTCA(1)

📦
version 6.0.7 · 4 versions
, in fedora 43, fedora 44

💖 PKI --ESTCA(1) — strongSwan, bestie edition 💖

okay so before we even get into it: this is a page from the strongSwan manual, and it's all about pki --estca, a little sub-command with big "let me go fetch your CA certs for you" energy. sit down, grab a snack 🍓, and let's get into it.

✨ NAME ✨

pki --estca — Get CA certificate[s] from an EST server 🎀

like. that's literally the whole job. it goes and gets CA certs. from an EST server. iconic behavior honestly.

🌸 SYNOPSIS 🌸

pki --estca --url url [--label label] --cacert file [--caout file]
            [--outform encoding] [--force] [--debug level]

pki --estca --options file

pki --estca -h | --help

three whole moods. you can go full manual mode, you can hand it an options file, or you can just ask it for help. no wrong answers bestie 💅

🦋 DESCRIPTION 🦋

so this is a sub-command of pki(1) (iykyk), and what it does is gets CA certificates via https from an EST server, using the /cacerts operation of the Enrollment over Secure Transport protocol — which is RFC 7030 if you wanna go read it, nerd 🧚 (affectionate).

that's it. that's the vibe. it's giving "errand runner for your trust chain."

👑 OPTIONS 👑

  • -h, --help — prints usage info plus a little summary of everything you can pass. your "wait what do I do again" button 🫶
  • -v, --debug level — sets the debug level. default is 1. turn it up when you wanna see everything it's doing, bestie 🔥
  • -+, --options file — reads the command line options from a file instead of you typing them all out. saving your wrists, one file at a time 💖
  • -u, --url url — URL of the SCEP server. (yes, it says SCEP. that's what it says. I'm just the messenger 🙈)
  • -l, --label label — the label inside the EST server path.
  • -C, --cacert file — a CA certificate in the trust chain, used for verifying the signature of the EST TLS server. and listen — you can use this one multiple times. stack them up like friendship bracelets 🌈
  • -c, --caout file — if you pass this, it's the path where the fetched root CA certificate file gets stored. here's the tea though ☕: if several CA certs come down, the --caout value becomes a template, and unique filenames get derived from it for the intermediate or sub CA certs (*-1, *-2, etc.). if there's no file suffix, then depending on --outform either .der (the default) or .pem gets automatically appended. and if --caout is missing while --outform is set to pem? then a PEM-encoded CA certificate bundle gets written to stdout. periodt ✨
  • -f, --outform encoding — the encoding of the created certificate file. either der (ASN.1 DER) or pem (Base64 PEM). defaults to der.
  • -F, --force — forces overwrite of existing files. be brave 🩷

🌈 EXAMPLES 🌈

to save some typing work (real), these command line options are stored in an est.opt file:

--url https://pki.strongswan.org:8443
--cacert tlsca.crt
--cacert tlsca-1.crt
NOTE: for a successful HTTPS connection, trust must be established into the EST server certificate. the TLS trust chain — including the root CA certificate and optionally intermediate CA certificates — must be given using multiple --cacert options. no shortcuts, bestie 💀

so, an EST server sends a root CA and an intermediate CA certificate:

pki --estca --options est.opt --caout myca.crt

and here's the whole saga it prints at you:

negotiated TLS 1.3 using suite TLS_AES_256_GCM_SHA384
received TLS server certificate 'C=CH, O=strongSwan Project, CN=pki.strongswan.org'
  using certificate "C=CH, O=strongSwan Project, CN=pki.strongswan.org"
  using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 1
Root CA cert "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  serial: 65:31:00:ca:79:da:16:6b:aa:ac:89:e2:a8:f9:49:c3:10:ab:64:54
  SHA256: 96:70:50:51:cd:b9:e7:94:6b:04:f6:15:45:80:fc:90:85:01:71:2a:f6:4f:d1:1b:2d:a1:7e:eb:bf:dd:be:86
  SHA1  : 8e:f3:78:b0:34:a6:c1:6a:7b:c6:f5:91:eb:e5:46:9b:0d:0a:a7:ba (jvN4sDSmwWp7xvWR6+VGmw0Kp7o)
Root CA equals trusted TLS Root CA
Root CA cert is trusted, valid until Aug 12 15:51:34 2032, 'myca.crt'
Sub CA cert "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  serial: 74:f9:7e:72:7d:b8:fd:f2:c6:e5:1b:fa:37:f9:cb:87:bf:9c:ea:e2
  SHA256: a3:5b:4b:12:d5:8f:68:7b:05:11:08:27:f5:42:62:b8:b5:01:1b:19:37:9c:28:78:5d:37:08:69:6a:8c:07:bf
  SHA1  : 8c:e6:67:67:c2:23:89:7b:d0:bc:b1:50:d2:1c:bc:8d:8d:69:15:11 (jOZnZ8IjiXvQvLFQ0hy8jY1pFRE)
  using certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 0
Sub CA cert is trusted, valid until Aug 12 15:51:34 2027, 'myca-1.crt'
NOTE: the trustworthiness of the root CA certificate is either verified automatically if the Root CA certificate of the TLS trust chain is the same as that of the Issuing CA. otherwise 😭 trust has to be established manually by verifying the SHA256 or SHA1 fingerprint of the DER-encoded certificate — the kind that's e.g. listed on the official PKI website, or by some other means. do not skip this. seriously. 🚨

the stored certificate files in DER format can be overwritten by PEM-encoded versions with:

pki --estca --options est.opt --caout myca.crt --outform pem --force

and a CA certificate bundle in PEM format gets written to stdout like this:

pki --estca --options est.opt --outform pem > cacerts.pem

look at that redirect. main character energy, honestly ⭐

🎀 SEE ALSO 🎀

and that's the whole page, bestie!! you understood it, you slayed it, you're basically a PKI princess now 👑💅

this was strongSwan version 6.0.7, dated 2022-08-22 — so if you're reading this from the future, hi, hope the certs still validate 🦋💖

📦 where this page comes from