certrally

certrally is a command line client for certificate enrollment with the Certificate Management Protocol (CMP), Enrollment over Secure Transport (EST) and the Simple Certificate Enrolment Protocol (SCEP). The documentation is at misiektoja.github.io/certrally.

CMP (RFC 9810, which replaces RFC 4210, with the RFC 9483 profile)

• ir, cr, kur, p10cr and rr with a shared secret or a certificate
• Keys that the CA generates (central key generation)
• Requests forwarded by a registration authority in nested messages
• CA certificates, root CA updates, request templates and CRLs from the CA
• ping to check a server and mock to run a test CA on your machine
• Deliberately wrong messages with enroll --fault to test how a CA copes
• A step-by-step enroll that prints the matching command for scripts

EST (RFC 7030)

• Enrollment, renewal, server key generation, CA certificates and CSR attributes
• Authentication with a password, a bearer token, a TLS client certificate or TLS-SRP
• est mock to run a test EST CA on your machine

SCEP (RFC 8894)

• Enrollment, renewal and polling of pending requests, also in a later run
• CA certificates, the CA chain, the next CA certificate, certificates and CRLs from the CA
• Digest, cipher and HTTP method chosen from the server capabilities, with old algorithms on request
• scep mock to run a test SCEP CA on your machine

All protocols

• A live diagram of every message and plain explanations of failures
• RSA, ECDSA, Ed25519, ML-DSA, composite ML-DSA and ML-KEM keys, also offline with keygen. SCEP takes RSA and ECDSA keys
• No trust setup: certrally trusts the CA it talks to or the one in --ca-cert
• Warnings about responses that break the RFCs and a strict profile that rejects them
• JSON output, capture files and exit statuses for scripts
• inspect and lint to decode recorded messages and check them

Tested with EJBCA, Nokia NCM, Insta Certifier and the openssl cmp mock server over CMP, with Cisco libest over EST and with EJBCA, Nokia NCM, OpenXPKI and micromdm/scep over SCEP. See Tested servers.

Install

Each release has archives for Linux, macOS and Windows on amd64 and arm64. A binary downloaded with a browser on macOS needs xattr -d com.apple.quarantine certrally before its first run, because it is not notarized.

With Homebrew on macOS or Linux, which also installs shell completions:

brew install misiektoja/tap/certrally

As a container image for linux/amd64 and linux/arm64:

docker run --rm ghcr.io/misiektoja/certrally --help

The image runs as an unprivileged user. To save files to the current directory, run it as your user and mount the directory:

docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/work" -w /work -e CERTRALLY_SECRET \
  ghcr.io/misiektoja/certrally enroll --server https://ca.example.com/.well-known/cmp \
  --ref device-42 --cert-out device.pem --key-out device.key

From source with Go 1.27.3 or newer:

go install github.com/misiektoja/certrally/cmd/certrally@latest

Releases are signed with cosign and carry GitHub build provenance and SBOMs. Verify a download shows how to check one.

Quick start

certrally mock runs a CMP test CA on your machine. Start it in one terminal:

certrally mock --secret demo-secret --ca-out ca.pem

Request a certificate from another terminal in the same directory:

certrally enroll --server http://127.0.0.1:8080/.well-known/cmp --ref demo --ca-cert ca.pem --secret demo-secret --cert-out device.pem --key-out device.key

The test CA prints the same command when it starts. certrally draws each message as it is sent and received, then describes the certificate:

  certrally                                           127.0.0.1:8080
  │                                                                │
  │ ir  PBMAC1  432 B                                              │
  │ ─────────────────────────────────────────────────────────────▶ │
  │                            ip  accepted  PBMAC1  1.4 KiB  8 ms │
  │ ◀───────────────────────────────────────────────────────────── │
  │ certConf  PBMAC1  281 B                                        │
  │ ─────────────────────────────────────────────────────────────▶ │
  │                                   pkiconf  PBMAC1  629 B  2 ms │
  │ ◀───────────────────────────────────────────────────────────── │

✓ Certificate issued
  Subject  CN=demo
  Issuer   CN=Test CA
  Serial   93:AC:6F:24:1A:B9:81:D1:62:EA:8A:C0:2A:6A:DD:FC
  Valid    2026-11-02 17:35 UTC to 2027-11-02 17:36 UTC
  Key      ECDSA P-256
  Status   accepted
  Saved    device.key, device.pem

Using CMP, Using EST and Using SCEP continue with a real CA.

Usage

certrally --help
certrally enroll --help
certrally --version

enroll, poll, revoke, cacerts, ping and mock use CMP and also run under certrally cmp. The EST and SCEP commands run under certrally est and certrally scep. certrally completion bash|zsh|fish|powershell prints a shell completion script and certrally man prints a man page.

Documentation

The full documentation is at misiektoja.github.io/certrally:

• Install
• Getting started: the three protocols, commands, a first enrollment against a test CA and trust
• CMP
  • Using CMP: enrollment, key updates, revocation, request options, collecting a certificate later, ML-KEM keys, keys that the CA generates, registration authorities, trust, CA information and ping
  • CMP test CA: certrally mock and its fault flags
  • Testing a CA with faulty messages: enroll --fault and poll --fault
• EST
  • Using EST: commands, sign-in options, bootstrap, proxies, waiting, channel binding and server-generated keys
  • EST test CA: certrally est mock
• SCEP
  • Using SCEP: commands, trust, the challenge password, algorithms, pending requests, renewal and queries
  • SCEP test CA: certrally scep mock
• Guides
  • Keys and output files: key types, encrypted keys, keygen and DER output
  • Scripts and exit status: --json, capture files and exit statuses
  • JSON output and capture files
  • RFC checks: the CMP, EST and SCEP rules certrally checks and --profile
  • Inspect and lint recorded messages
  • Output and colour
• Tested servers
• Verify a download

The pages are also readable on GitHub in docs/.

Contributing

See CONTRIBUTING.md. Report security issues as described in SECURITY.md.

License

certrally is licensed under the Apache License 2.0.