CMP support

[pedroaston]

Hey there,

from reading the docs and using the JWK and the SCEP provisioners, for certificate management of web apps and Cisco Routers respectively, I didn't saw a CMP provisioner implementation.

My usecase is to do certificate management in Nokia SROS routers, which only support CMPv2. Do you have in your roadmap plans to implement CMP certificate management (RFC4210, Update Draft)?

Edit:
EST (RFC7030) is another valid option for enrollment in Nokia routers. Are there any developments in this front? I saw that @hslatman already done some digging in caddy-est.

Thanks in Advance 😃

[hslatman]

Hey @pedroaston,

Nice find 😄; it's been a while since I looked at that! I think adding EST to step-ca might be fun. I'm not aware of concrete customer asks for EST specifically, although it has come up in internal discussions. My similar "hack project" at https://github.com/hslatman/caddy-scep is what led to me integrating SCEP support in step-ca, so it might happen some day 🙂

For CMP we do have some customer requests, so it's on our list of things we could do. It hasn't been concretely roadmapped yet, though. I think CMP (and CMC) are more widespread than EST, so from that viewpoint, it make sense to give that a higher priority. I've made a note of this discussion on our internal board, so that this additional ask about CMP is registered.

[ralienpp]

CMP support is something I'm also interested in, and there's an experimental client that can handle some types of requests.

Could someone familiar with the code-base create a "skeleton" with the right function definitions, which could then be filled in with the actual logic?