Struct DogtagClient 

pub struct DogtagClient { /* private fields */ }

Implementations

impl DogtagClient

pub async fn get_certificate(&self, serial: &str) -> DogtagResult<CertInfo>

Retrieve a single certificate by serial number.

Sends GET /ca/rest/certs/{serial}. The serial number should be the hex-encoded certificate serial (e.g., “0x1” or “1”).

pub async fn revoke_certificate( &self, serial: &str, reason: RevocationReason, ) -> DogtagResult<()>

Revoke a certificate by serial number.

Sends POST /ca/rest/agent/certs/{serial}/revoke with the specified revocation reason. Requires agent-level authentication (mTLS with an agent certificate).

The revocation reason code follows RFC 5280 S5.3.1.

pub async fn list_certificates( &self, filter: CertFilter, ) -> DogtagResult<Vec<CertInfo>>

List certificates matching the given filter.

Sends GET /ca/rest/certs with query parameters derived from the CertFilter. Supports pagination via start and size fields.

impl DogtagClient

pub fn new(config: &DogtagConfig) -> DogtagResult<Self>

pub async fn health_check(&self) -> DogtagResult<bool>

pub fn base_url(&self) -> &str

impl DogtagClient

pub async fn submit_cmc_request(&self, cmc_der: &[u8]) -> DogtagResult<Vec<u8>>

Submit a Full CMC request to Dogtag.

Sends POST /ca/ee/ca/profileSubmitCMCFull with the raw CMC request bytes (DER-encoded CMS/PKCS#7). Returns the CMC response bytes for direct relay to the EST client.

This is a pure passthrough: kipuka’s /fullcmc endpoint receives a CMC request from the EST client and forwards it to Dogtag without interpretation. The response is similarly relayed back.

Content Types

• Request: application/pkcs7-mime (CMC request, DER)
• Response: application/pkcs7-mime (CMC response, DER)

impl DogtagClient

pub async fn enroll_certificate( &self, csr_pem: &str, profile_id: &str, ) -> DogtagResult<EnrollResult>

Enroll a certificate using a PKCS#10 CSR and enrollment profile.

Sends POST /ca/rest/certrequests with the CSR embedded in the specified enrollment profile. The profile controls certificate extensions, key usage, validity period, and approval workflow.

Arguments

• csr_pem - PEM-encoded PKCS#10 certificate signing request.
• profile_id - Dogtag enrollment profile ID (e.g., “caServerCert”).

Returns

An EnrollResult containing the request ID, status, and the DER-encoded certificate if the profile uses auto-approval. If the profile requires agent approval, the status will be EnrollStatus::Pending and the certificate will be None.

pub async fn enroll_certificate_with_type( &self, request_data: &str, profile_id: &str, request_type: &str, ) -> DogtagResult<EnrollResult>

Enroll a certificate with an explicit request type (pkcs10 or crmf).

pub async fn server_keygen( &self, profile_id: &str, subject_uid: &str, subject_cn: &str, p12_password: &str, key_type: &str, key_size: u32, ) -> DogtagResult<ServerKeygenResult>

Server-side key generation via Dogtag’s caServerKeygen_UserCert profile.

Dogtag CA + KRA generate the key pair internally. The CA archives the private key via the KRA (using ML-KEM if the transport cert is ML-KEM-1024) and returns the cert + PKCS#12.

pub async fn get_enrollment_status( &self, request_id: &str, ) -> DogtagResult<EnrollResult>

Poll the status of an enrollment request.

Sends GET /ca/rest/certrequests/{request_id} to check whether a pending enrollment has been approved or rejected. Used for EST Disconnected mode (RFC 7030 S4.4.2) where the CA requires out-of-band approval before issuing the certificate.

impl DogtagClient

pub async fn list_profiles(&self) -> DogtagResult<Vec<ProfileInfo>>

List all enrollment profiles.

Sends GET /ca/rest/profiles and returns summary information for each profile. Only enabled and visible profiles are typically relevant for EST enrollment.

pub async fn get_profile(&self, id: &str) -> DogtagResult<ProfileDetail>

Get detailed profile definition by ID.

Sends GET /ca/rest/profiles/{id} and returns the full profile definition including policy sets, constraints, and defaults.

pub async fn get_profile_constraints( &self, id: &str, ) -> DogtagResult<ProfileConstraints>

Extract CSR-relevant constraints from a profile.

Parses the profile’s policy sets to extract key type constraints, key usage extensions, and subject DN requirements. The returned ProfileConstraints can be translated into EST CSR attributes for the /csrattrs endpoint.