Struct DogtagClient 

pub struct DogtagClient { /* private fields */ }

HTTP client for Dogtag CA REST API operations.

Wraps a reqwest::Client configured with mTLS agent credentials for authenticating to the Dogtag PKI REST API. All methods perform automatic retry on transient failures (HTTP 5xx and connection errors).

Construction

Use DogtagClient::new with a DogtagConfig to build a client. The agent certificate and key files are read during construction and the TLS identity is established once for the lifetime of the client.

Thread Safety

DogtagClient is Send + Sync and can be shared across async tasks via Arc<DogtagClient>.

Implementations

impl DogtagClient

pub async fn get_certificate(&self, serial: &str) -> DogtagResult<CertInfo>

Retrieve a single certificate by serial number.

Sends GET /ca/rest/certs/{serial}. The serial number should be the hex-encoded certificate serial (e.g., “0x1” or “1”).

pub async fn revoke_certificate( &self, serial: &str, reason: RevocationReason, ) -> DogtagResult<()>

Revoke a certificate by serial number.

Sends POST /ca/rest/agent/certs/{serial}/revoke with the specified revocation reason. Requires agent-level authentication (mTLS with an agent certificate).

The revocation reason code follows RFC 5280 S5.3.1.

pub async fn list_certificates( &self, filter: CertFilter, ) -> DogtagResult<Vec<CertInfo>>

List certificates matching the given filter.

Sends GET /ca/rest/certs with query parameters derived from the CertFilter. Supports pagination via start and size fields.

impl DogtagClient

pub fn new(config: &DogtagConfig) -> DogtagResult<Self>

Create a new Dogtag client from configuration.

Reads the agent certificate, key, and CA certificate files to configure mTLS. Returns an error if any file cannot be read or if the TLS identity cannot be constructed.

pub async fn health_check(&self) -> DogtagResult<bool>

Check Dogtag CA health by querying the info endpoint.

Sends GET /ca/rest/info and returns true if the CA responds with HTTP 200.

pub fn base_url(&self) -> &str

Return the base URL (for pool routing).

impl DogtagClient

pub async fn submit_cmc_request(&self, cmc_der: &[u8]) -> DogtagResult<Vec<u8>>

Submit a Full CMC request to Dogtag.

Sends POST /ca/ee/ca/profileSubmitCMCFull with the raw CMC request bytes (DER-encoded CMS/PKCS#7). Returns the CMC response bytes for direct relay to the EST client.

This is a pure passthrough: kipuka’s /fullcmc endpoint receives a CMC request from the EST client and forwards it to Dogtag without interpretation. The response is similarly relayed back.

Content Types

• Request: application/pkcs7-mime (CMC request, DER)
• Response: application/pkcs7-mime (CMC response, DER)

impl DogtagClient

pub async fn enroll_certificate( &self, csr_pem: &str, profile_id: &str, ) -> DogtagResult<EnrollResult>

Enroll a certificate using a PKCS#10 CSR and enrollment profile.

Sends POST /ca/rest/certrequests with the CSR embedded in the specified enrollment profile. The profile controls certificate extensions, key usage, validity period, and approval workflow.

Arguments

• csr_pem - PEM-encoded PKCS#10 certificate signing request.
• profile_id - Dogtag enrollment profile ID (e.g., “caServerCert”).

Returns

An EnrollResult containing the request ID, status, and the DER-encoded certificate if the profile uses auto-approval. If the profile requires agent approval, the status will be EnrollStatus::Pending and the certificate will be None.

pub async fn get_enrollment_status( &self, request_id: &str, ) -> DogtagResult<EnrollResult>

Poll the status of an enrollment request.

Sends GET /ca/rest/certrequests/{request_id} to check whether a pending enrollment has been approved or rejected. Used for EST Disconnected mode (RFC 7030 S4.4.2) where the CA requires out-of-band approval before issuing the certificate.

impl DogtagClient

pub async fn list_profiles(&self) -> DogtagResult<Vec<ProfileInfo>>

List all enrollment profiles.

Sends GET /ca/rest/profiles and returns summary information for each profile. Only enabled and visible profiles are typically relevant for EST enrollment.

pub async fn get_profile(&self, id: &str) -> DogtagResult<ProfileDetail>

Get detailed profile definition by ID.

Sends GET /ca/rest/profiles/{id} and returns the full profile definition including policy sets, constraints, and defaults.

pub async fn get_profile_constraints( &self, id: &str, ) -> DogtagResult<ProfileConstraints>

Extract CSR-relevant constraints from a profile.

Parses the profile’s policy sets to extract key type constraints, key usage extensions, and subject DN requirements. The returned ProfileConstraints can be translated into EST CSR attributes for the /csrattrs endpoint.