docs-dev/img/est-ca-cloud-setup.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="662px" preserveAspectRatio="none" style="width:877px;height:662px;" version="1.1" viewBox="0 0 877 662" width="877px" zoomAndPan="magnify"><defs><filter height="300%" id="f1h0nf4bkk1t9b" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4.0" dy="4.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><text fill="#000000" font-family="sans-serif" font-size="18" lengthAdjust="spacingAndGlyphs" textLength="98" x="389.5" y="26.6992">Cloud Setup</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="46" x2="46" y1="73.5" y2="614.2969"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="571.5" x2="571.5" y1="73.5" y2="614.2969"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="626.5" x2="626.5" y1="73.5" y2="614.2969"/><rect fill="#FEFECE" filter="url(#f1h0nf4bkk1t9b)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="72" x="8" y="38.0938"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="58" x="15" y="58.082">Operator</text><rect fill="#FEFECE" filter="url(#f1h0nf4bkk1t9b)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="72" x="8" y="613.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="58" x="15" y="633.2852">Operator</text><rect fill="#FEFECE" filter="url(#f1h0nf4bkk1t9b)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="549.5" y="38.0938"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="556.5" y="58.082">EST</text><rect fill="#FEFECE" filter="url(#f1h0nf4bkk1t9b)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="549.5" y="613.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="556.5" y="633.2852">EST</text><rect fill="#FEFECE" filter="url(#f1h0nf4bkk1t9b)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="604.5" y="38.0938"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="611.5" y="58.082">DPS</text><rect fill="#FEFECE" filter="url(#f1h0nf4bkk1t9b)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="604.5" y="613.2969"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="611.5" y="633.2852">DPS</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="46" x2="88" y1="104.7344" y2="104.7344"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="88" x2="88" y1="104.7344" y2="117.7344"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="47" x2="88" y1="117.7344" y2="117.7344"/><polygon fill="#A80036" points="57,113.7344,47,117.7344,57,121.7344,53,117.7344" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="53" y="99.5605">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="81" x="64" y="99.5605">Create CA cert</text><polygon fill="#A80036" points="560,188.6719,570,192.6719,560,196.6719,564,192.6719" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="46" x2="566" y1="192.6719" y2="192.6719"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="53" y="164.6465">2</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="491" x="64" y="141.7949">Register one or more CA certs with EST server to be used for verifying bootstrap cert,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="178" x="64" y="157.0293">minting new EST identity certs,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="138" x="64" y="172.2637">minting device CA certs,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="246" x="64" y="187.498">and optionally minting device identity certs</text><path d="M274,205.6719 L274,550.6719 L865,550.6719 L865,215.6719 L855,205.6719 L274,205.6719 " fill="#FBFB77" filter="url(#f1h0nf4bkk1t9b)" style="stroke: #A80036; stroke-width: 1.0;"/><path d="M855,205.6719 L855,215.6719 L865,215.6719 L855,205.6719 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="452" x="280" y="222.7324">Some on-prem EST servers only support one openssl config for issuing certs.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="485" x="280" y="237.9668">For example, they can be configured to only issue CA certs, or only issue client certs,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="326" x="280" y="253.2012">or only issue certs that are both client certs and CA certs.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="407" x="280" y="268.4355">They cannot be configured to issue certs differently based on the CSR</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="245" x="280" y="283.6699">or other parameters of the client's request.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="283" y="298.9043"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="335" x="280" y="314.1387">However, some cloud-based EST servers do support this,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="463" x="280" y="329.373">by letting the user configure different EST endpoints for different kinds of certs.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="483" x="280" y="344.6074">So the user could configure one EST endpoint that only issues device identity certs,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="570" x="280" y="359.8418">another that only issues device CA certs, and so on. These endpoints have individual configuration,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="438" x="280" y="375.0762">so they can issue different kinds of certs with different signing CA certs and</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="157" x="280" y="390.3105">different issuance policies.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="283" y="405.5449"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="368" x="280" y="420.7793">Since the endpoints are still served by the same server instance,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="277" x="280" y="436.0137">the same EST identity cert works for all of them.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="535" x="280" y="451.248">It's not like multiple independent EST servers that would each require a separate identity cert.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="283" y="466.4824"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="455" x="280" y="481.7168">This means the user could have a single EST endpoint, in which case they have</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="541" x="280" y="496.9512">a single CA cert that signs both device identity and other certs, or they have multiple endpoints</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="499" x="280" y="512.1855">where one only signs device identity certs with a CA dedicated for device identity certs.</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="517" x="280" y="527.4199">In the former case, the common CA is the one they would upload to DPS. In the latter case,</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="338" x="280" y="542.6543">the device identity CA is the one they would upload to DPS.</text><polygon fill="#A80036" points="615,592.2969,625,596.2969,615,600.2969,619,596.2969" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="46" x2="621" y1="596.2969" y2="596.2969"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="53" y="583.5059">3</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="147" x="64" y="575.8887">Register CA cert with DPS</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="259" x="64" y="591.123">to be used for validating device identity certs</text><!--MD5=[9a538cd3429cd8846d407e16dba3688d]
@startuml

title Cloud Setup

participant "Operator" as operator
participant "EST" as est
participant "DPS" as dps

autonumber

operator -> operator: Create CA cert
operator -> est: Register one or more CA certs with EST server to be used for verifying bootstrap cert,\nminting new EST identity certs,\nminting device CA certs,\nand optionally minting device identity certs

note over est
Some on-prem EST servers only support one openssl config for issuing certs.
For example, they can be configured to only issue CA certs, or only issue client certs,
or only issue certs that are both client certs and CA certs.
They cannot be configured to issue certs differently based on the CSR
or other parameters of the client's request.

However, some cloud-based EST servers do support this,
by letting the user configure different EST endpoints for different kinds of certs.
So the user could configure one EST endpoint that only issues device identity certs,
another that only issues device CA certs, and so on. These endpoints have individual configuration,
so they can issue different kinds of certs with different signing CA certs and
different issuance policies.

Since the endpoints are still served by the same server instance,
the same EST identity cert works for all of them.
It's not like multiple independent EST servers that would each require a separate identity cert.

This means the user could have a single EST endpoint, in which case they have
a single CA cert that signs both device identity and other certs, or they have multiple endpoints
where one only signs device identity certs with a CA dedicated for device identity certs.
In the former case, the common CA is the one they would upload to DPS. In the latter case,
the device identity CA is the one they would upload to DPS.
end note

operator -> dps: Register CA cert with DPS\nto be used for validating device identity certs

@enduml

PlantUML version 1.2020.17(Sat Sep 19 05:30:11 PDT 2020)
(GPL source distribution)
Java Runtime: OpenJDK Runtime Environment
JVM: OpenJDK 64-Bit Server VM
Default Encoding: UTF-8
Language: en
Country: US
--></g></svg>