Class EstService

java.lang.Object
zeroecho.pki.server.est.EstService
public final class EstService extends Object
EST RFC 7030 protocol service.

Implements the five core EST operations over the lifecycle-owned realm session. No BouncyCastle imports are present; all CMS/cryptographic codec operations are delegated to EstCmsCodec (which delegates to Pkix).

Endpoint registration uses the durable realm registry; operation methods are stateless with respect to the endpoint registry and safe to call concurrently.

Since:
1.0

  • Constructor Details

    • EstService

      public EstService(ServerRealmContext realm)
      Creates an EST service over the given realm.
      Parameters:
      realm - lifecycle-owned realm context

  • Method Details

    • register

      public void register(EstEndpoint endpoint)
      Registers an EST endpoint, replacing any existing endpoint with the same label.
      Parameters:
      endpoint - the endpoint to register

    • deregister

      public Optional<EstEndpoint> deregister(String label)
      Removes the endpoint with the given label.
      Parameters:
      label - URL-safe endpoint label
      Returns:
      the removed endpoint, or empty if absent

    • find

      public Optional<EstEndpoint> find(String label)
      Returns the endpoint for the given label.
      Parameters:
      label - URL-safe endpoint label
      Returns:
      the endpoint, or empty when not registered

    • list

      public List<EstEndpoint> list()
      Collects active endpoints in deterministic store-key order. Concurrent changes across persistence pages need not form one atomic snapshot.
      Returns:
      current endpoint list

    • cacerts

      public byte[] cacerts(EstEndpoint endpoint) throws EstProtocolException
      Returns the CA certificate chain for the endpoint as MIME-base64-encoded CMS certs-only (RFC 7030 section 4.1).
      Parameters:
      endpoint - the EST endpoint
      Returns:
      MIME-base64-encoded CMS certs-only DER
      Throws:
      EstProtocolException - if the CA or chain is unavailable

    • simpleenroll

      public EstService.EnrollmentResult simpleenroll(EstEndpoint endpoint, byte[] csrBody, X509Certificate clientCert) throws EstProtocolException
      Performs EST simpleenroll (RFC 7030 section 4.2): verifies the client CSR, durably admits the request and returns its current approval or issuance outcome. Completed results contain MIME-base64 CMS certificates and the frozen issuer chain.
      Parameters:
      endpoint - the EST endpoint
      csrBody - PKCS#10 DER, PEM, or RFC 7030 base64; self-signature must be valid
      clientCert - authenticated mTLS client certificate
      Returns:
      completed CMS response, pending approval/signing response, or terminal rejection
      Throws:
      EstProtocolException - if input validation or durable admission is unavailable

    • simpleenroll

      public EstService.EnrollmentResult simpleenroll(EstEndpoint endpoint, byte[] csrBody, X509Certificate clientCert, CancellationSignal cancellation) throws EstProtocolException
      Admits or continues enrollment with cancellation before the durable signing claim.
      Parameters:
      endpoint - exact endpoint
      csrBody - bounded original PKCS#10 DER, PEM, or base64
      clientCert - verified TLS end-client certificate
      cancellation - transport cancellation signal
      Returns:
      durable response outcome
      Throws:
      EstProtocolException - if validation or admission fails

    • simplereenroll

      public EstService.EnrollmentResult simplereenroll(EstEndpoint endpoint, byte[] csrBody, X509Certificate clientCert) throws EstProtocolException
      Performs EST simplereenroll (RFC 7030 section 4.2.2): renews the client's certificate after proving the authoritative predecessor identity and satisfying the frozen approval and proof policy. Repeated identical requests retain one operation.
      Parameters:
      endpoint - the EST endpoint
      csrBody - renewal PKCS#10 DER, PEM, or base64; self-signature must be valid
      clientCert - authenticated mTLS client certificate (the predecessor)
      Returns:
      completed CMS response, pending approval/signing response, or terminal rejection
      Throws:
      EstProtocolException - if identity validation or durable admission is unavailable

    • simplereenroll

      public EstService.EnrollmentResult simplereenroll(EstEndpoint endpoint, byte[] csrBody, X509Certificate clientCert, CancellationSignal cancellation) throws EstProtocolException
      Admits or continues exact-identity renewal with pre-claim cancellation.
      Parameters:
      endpoint - exact endpoint
      csrBody - bounded original PKCS#10 DER, PEM, or base64
      clientCert - verified TLS predecessor certificate
      cancellation - transport cancellation signal
      Returns:
      durable response outcome
      Throws:
      EstProtocolException - if validation or admission fails

    • csrattrs

      public byte[] csrattrs(EstEndpoint endpoint)
      Returns CSR attribute suggestions as MIME-base64-encoded RFC 7030 CsrAttrs DER (RFC 7030 section 4.5).
      Parameters:
      endpoint - the EST endpoint
      Returns:
      MIME-base64-encoded CsrAttrs DER (empty sequence when no suggestions)

    • serverkeygen

      public EstServerKeygenResponse serverkeygen(EstEndpoint endpoint, byte[] csrBody, X509Certificate clientCert) throws EstProtocolException
      Performs server-key generation through durable encrypted-artifact admission. This overload has no caller cancellation signal.
      Parameters:
      endpoint - registered endpoint
      csrBody - exact DER, PEM or MIME-base64 PKCS#10 template
      clientCert - authenticated TLS recipient
      Returns:
      pending, terminal or lazily leased encrypted delivery
      Throws:
      EstProtocolException - if validation or custody is unavailable

    • serverkeygen

      public EstServerKeygenResponse serverkeygen(EstEndpoint endpoint, byte[] csrBody, X509Certificate clientCert, CancellationSignal cancellation) throws EstProtocolException
      Freezes the authenticated original template and reserves capacity before generating a key. Ciphertext is generator-signed, encrypted and durably attached before approval or issuance. Exact retries resume the retained transaction and never regenerate a key. Template proof is ignored as required by RFC 7030; the generated CSR undergoes normal frozen-profile proof checks.
      Parameters:
      endpoint - registered endpoint
      csrBody - original template in DER, PEM or MIME-base64 form
      clientCert - actual authenticated TLS recipient
      cancellation - checked before generation, attachment and dispatch
      Returns:
      typed protocol status with resource-free deferred delivery
      Throws:
      EstProtocolException - if input, negotiation, policy or custody fails