Struct EstLabelConfig 

pub struct EstLabelConfig {

    pub name: String,
    pub ca_id: Option<String>,
    pub ca_pool: Vec<String>,
    pub auth_methods: Vec<EstAuthMethod>,
    pub csr_attributes: Vec<String>,
    pub csr_template: Option<CsrTemplate>,
    pub require_cn_match: bool,
    pub require_san_match: bool,
    pub permitted_dns_names: Vec<String>,
    pub permitted_ip_addresses: Vec<String>,
    pub permitted_emails: Vec<String>,
    pub max_validity_days: Option<u32>,
    pub disconnected: Option<bool>,
}

[[est.label]] — per-label enrollment profile.

Each label provides an independent enrollment namespace with its own CA routing, authentication requirements, and CSR attribute set.

[[est.label]]
name = "devices"
ca_id = "device-ca"
auth_methods = ["mtls", "otp"]
require_cn_match = true

Fields

name: String

Label name used in the URL path.

Must be a non-empty string matching ^[a-z0-9][a-z0-9_-]*$.

ca_id: Option<String>

CA identifier to use for enrollments under this label.

Must reference a [[ca]] entry by its id field. When absent, the default CA is used.

ca_pool: Vec<String>

Explicit authorization for alternate issuers under this label.

auth_methods: Vec<EstAuthMethod>

Allowed authentication methods for this label.

When empty, all globally-enabled auth methods are accepted.

csr_attributes: Vec<String>

Per-label CSR attribute hints (overrides global csr_attributes for this label).

csr_template: Option<CsrTemplate>

Per-label CSR template (overrides global csr_template for this label).

require_cn_match: bool

Require that the CSR Common Name matches the authenticated identity.

When true, the server rejects CSRs where the CN does not match the client’s authenticated principal name. NIAP CA PP FDP_ACF.1 identity binding — enforced in crate::auth::enroll_authz.

require_san_match: bool

Require the authenticated identity to appear as a Subject Alternative Name entry (dNSName, rfc822Name, or iPAddress, matched by type).

NIAP CA PP FDP_ACF.1 identity binding. Complements require_cn_match; both may be set. Default: false.

permitted_dns_names: Vec<String>

Name-authorization allowlist of permitted dNSName patterns (RFC 6125, wildcards allowed). When non-empty, every dNSName SAN in the CSR must match one entry, bounding this label to a fixed namespace.

permitted_ip_addresses: Vec<String>

Name-authorization allowlist of permitted iPAddress SANs (textual form, e.g. "10.0.0.1" or "2001:db8::1"). When non-empty, every iPAddress SAN in the CSR must equal one entry.

permitted_emails: Vec<String>

Name-authorization allowlist of permitted rfc822Name patterns (full address or bare domain). When non-empty, every rfc822Name SAN in the CSR must match one entry.

max_validity_days: Option<u32>

Maximum validity period (days) for certificates issued under this label.

Overrides the CA’s default validity_days for this label.

disconnected: Option<bool>

Enable disconnected mode for this specific label. Overrides the global [est].disconnected setting.

Trait Implementations

impl Clone for EstLabelConfig

fn clone(&self) -> EstLabelConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EstLabelConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for EstLabelConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.