Struct EstConfig 

pub struct EstConfig {

    pub simpleenroll: bool,
    pub simplereenroll: bool,
    pub fullcmc: bool,
    pub cmc_truststore_file: Option<String>,
    pub serverkeygen: bool,
    pub csrattrs: bool,
    pub default_profile: Option<String>,
    pub csr_attributes: Vec<String>,
    pub csr_template: Option<CsrTemplate>,
    pub labels: Vec<EstLabelConfig>,
    pub disconnected: bool,
    pub disconnected_retry_after_secs: u64,
    pub renewal_window_days: u32,
    pub renewal_retry_after_secs: u64,
}

[est] section — global EST protocol settings.

Fields

simpleenroll: bool

Enable the /simpleenroll endpoint (RFC 7030 §4.2).

simplereenroll: bool

Enable the /simplereenroll endpoint (RFC 7030 §4.2.2).

fullcmc: bool

Enable the /fullcmc endpoint (RFC 7030 §4.3).

Full CMC is rarely needed; disabled by default.

cmc_truststore_file: Option<String>

PEM file containing trust anchors for CMC RA signer verification.

When set, /fullcmc verifies the CMS SignedData signature against these certificates instead of only the target CA cert. This allows RA certificates issued by a different CA or intermediate to be accepted. When absent, the target CA certificate is used as the sole trust anchor.

serverkeygen: bool

Enable the /serverkeygen endpoint (RFC 7030 §4.4).

Server-side key generation requires HSM integration. Disabled by default.

csrattrs: bool

Enable the /csrattrs endpoint (RFC 7030 §4.5).

default_profile: Option<String>

Default enrollment profile applied when no label is specified.

When absent, enrollment requests without a label use the default CA and authentication policy.

csr_attributes: Vec<String>

CSR attribute hints returned by /csrattrs.

Each entry is an OID string (e.g., "1.2.840.113549.1.9.14" for the Certificate Extensions Request attribute).

csr_template: Option<CsrTemplate>

CSR template mode (draft-ietf-lamps-rfc7030-csrattrs / RFC 9908).

When set, the /csrattrs response includes a CertificationRequestInfoTemplate attribute that tells the client which subject DN fields, key algorithm, and extensions are required. This coexists with the OID-list mode.

labels: Vec<EstLabelConfig>

Per-label enrollment configurations.

disconnected: bool

Disconnected mode: accept enrollment requests without upstream CA connectivity (RHELBU-3536 R7-Disconnected).

When true, the server queues CSRs for deferred signing and returns 202 Accepted with a Retry-After header instead of the signed certificate.

disconnected_retry_after_secs: u64

Retry-After value (seconds) returned in disconnected mode. Default: 300 (5 minutes).

renewal_window_days: u32

Number of days before certificate expiry to start the suggested renewal window (draft-ietf-lamps-est-renewal-info).

The renewal window starts at not_after - renewal_window_days and ends one day before not_after.

renewal_retry_after_secs: u64

Retry-After value (seconds) returned in renewal-info responses to control client polling frequency.

Default: 86400 (1 day).

Trait Implementations

impl Clone for EstConfig

fn clone(&self) -> EstConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EstConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EstConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for EstConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.