Device Identity at Scale
Provision, renew and revoke device certificates with EST and CMP, from the factory line to the installed fleet.
Building blocks
| Need | EST (RFC 7030) | CMP (RFC 4210, RFC 9483 profile, over HTTP) |
|---|---|---|
| Device endpoint | POST /.well-known/est/<slug>/simpleenroll, /simplereenroll, /serverkeygen, GET /cacerts, /csrattrs | POST /.well-known/cmp/<alias>, Content-Type: application/pkixcmp |
| Set up | EST configuration on the CA and an EST service endpoint (its slug is the URL segment) | A CMP alias and a CMP service endpoint (its slug is the alias name) |
| Bootstrap credential | HTTP Basic: user = device identity, password = the endpoint secret (stored as a verifier, compared in constant time); a bearer token is also accepted | Shared secret: PBM (RFC 4210) or PBMAC1 (RFC 9480) protection of ir / cr |
| Renewal | simplereenroll | kur signed with the device's current certificate, or protected by the shared secret |
| Revocation | Management API or console; published in the CRL and OCSP | rr answered by a signed rp; management API |
| Server-side key generation | serverkeygen | Not supported (answered with a signed rejection) |
Factory provisioning
Use a dedicated device CA
Create (or import) an issuing CA for devices, separate from server and user CAs, so it can be revoked and rotated on its own. Consider a vault-resident CA key.
Configure the protocol
EST: auto-approve, a strong endpoint secret, a maximum validity. CMP: an HMAC secret, key update allowed, a maximum validity. Start the service endpoint.
Enroll on the line
Each device generates its key pair (on its secure element when it has one), builds a CSR (EST) or CRMF request (CMP) with its serial number as subject, and enrolls with the bootstrap credential. Give each device its own identity in the HTTP Basic user name: the EST per-identity limit is keyed on it.
Store the result
Store the issued certificate and the CA chain (/cacerts, or caPubs in the CMP answer) on the device.
Rotate the bootstrap secret
Rotate the bootstrap secret per batch or per line. It only authorizes enrollment; changing it does not affect issued certificates.
Renewal and revocation
- CMP: renew with a
kursigned by the device's current key and carrying its current certificate. Cockpit checks the chain to the alias CA and that the certificate is known and not revoked, so a stolen bootstrap secret alone cannot renew another device's identity this way. - EST:
simplereenrollis authenticated with the same endpoint credential as the first enrollment. Cockpit does not terminate TLS client authentication itself, so it does not bind re-enrollment to the certificate being renewed. If you need that binding, terminate mutual TLS at the ingress, or use CMPkur. - Revocation: revoke a device certificate from the console, the management API or with CMP
rr. Relying parties see it in the next CRL or through OCSP.
Rate limits
| Limit | Value |
|---|---|
| Per client address, all public enrollment protocols together | 1,000 requests per minute by default; on-premises deployments can set it from 60 to 100,000 with DKE_PROTOCOL_RATE_LIMIT_PER_MIN |
| Per EST identity and endpoint | 20 requests per minute |
| Per CMP alias | The alias's own rate limit (0 = none) |
The client address is the TCP peer, or the forwarded address when the request comes through a trusted proxy. A provisioning line or a fleet behind one NAT address shares one per-address budget: at the default, it cannot exceed 1,000 enrollments per minute (60,000 per hour), whatever the server capacity. For such deployments, raise the per-address limit (on DuoKey-hosted tenants, ask DuoKey support) or spread devices over several addresses behind an ingress that forwards the client address. The per-identity and per-alias limits still apply.
Throughput
Enrollment throughput depends on the CA key location (software, HSM or MPC), the database and the network. DuoKey has a benchmark that drives the full Cockpit stack — EST simpleenroll and simplereenroll, CMP ir, cr and kur — with one identity and one client address per simulated device, and checks every answer. Contact DuoKey to size a deployment against your fleet's enrollment and renewal rates; DuoKey PKI runs device identity in production at Volkswagen.