OpenSSL Studio / PKI Enrollment (EST + CMP)
What you will do: Generate an end-entity keypair, send a CMP Initial Request to an in-browser mock CA, run EST simpleenroll with the same key, then perform an ML-KEM-768 key update with encrCert proof of possession.
Worked example: Generate an ML-DSA-65 keypair and press Send CMP Initial Request: the mock CA issues a certificate chain-validated against its root and shows it decoded; the KEM key update then reports whether both shared secrets match.
Runtime and privacy: The cryptographic exercise runs in this browser. Review the site privacy terms before entering sensitive material; use synthetic inputs for learning and evaluation.
Browse all Crypto Lab tools · Learn with PKI Enrollment Protocols (EST & CMP)
For your role
- Developer / Engineer
- Generate an ML-DSA-65 keypair, Send CMP Initial Request with a subject DN and shared secret, Run simpleenroll for EST, then Run ML-KEM-768 KUR: the four steps are the RFC 9810 and RFC 7030 exchanges a client library implements.
- Security Architect
- The CMP Initial Request is ML-DSA signed and the key update uses an encrypted-certificate proof of possession for a KEM key: these two steps show how enrollment works when the key cannot sign.
- Researcher / Academic
- Compare the CMP and EST enrollments of the same key and the KEM key update's encrCert proof of possession against RFC 9810 and RFC 7030; the full module adds composite enrollment and certificate inspection.
- IT Ops / DevOps
- Regenerate CA and run the four steps: the CMP and EST requests and the PKCS#7 response are what your enrollment endpoints will exchange with devices after the switch.
Step 1 — Generate end-entity key
Educational use only — generated keys never leave the browser and are not certified for production. Real CA enrollment requires a vetted HSM and audited issuance pipeline.
Step 2 — CMP Initial Request (ML-DSA signed)
Both ends of the CMP exchange run inside the OpenSSL 3.6 WASM build via the execute_cmp_simulation shim: real OSSL_CMP_CTX client + real OSSL_CMP_SRV_CTX server, connected by OSSL_CMP_CTX_set_transfer_cb (no sockets, no file dance). The server's process_cert_request callback parses the CRMF template, builds an X509, and signs it with the mock CA's ML-DSA-65 key — actual issuance, not a pre-canned echo. The mock CA root is generated once in your browser and cached in IndexedDB.
Step 3 — EST simpleenroll (RFC 7030)
OpenSSL ships a CMP client but not an EST client. This step exercises the two EST-specific pieces directly: (1) the PKCS#10 CSR the client POSTs to /.well-known/est/simpleenroll, and (2) the PKCS#7 SignedData envelope the server returns. The HTTP+TLS transport is described in the Learn tab.
Generate the end-entity key in Step 1 first; simpleenroll builds the CSR from it.
Step 4 — CMP KEM Key Update (RFC 9810 encrCert POP)
ML-KEM keys can't sign, so signature-POP doesn't apply. The CA encapsulates the issued cert under the new ML-KEM public key; the EE proves possession by decapsulating. This step runs the full flow: CMP IR enrolls an ML-KEM-768 cert (CA signs with its ML-DSA-65 key), then encap → decap proves the EE holds the matching private key. If the two derived shared secrets match, POP succeeded.
Standards backing this exchange (4 RFCs + 2 FIPS)
The cert this step issues is fully spec-conformant — every byte traces to a published standard:
| Layer | Standard | What it specifies |
|---|---|---|
| SPKI algorithm OID | RFC 9935 | ML-KEM-512/768/1024 OIDs in X.509 |
| SPKI key bytes (1184 B) | FIPS 203 | ML-KEM key generation + encap/decap |
| signatureAlgorithm OID | RFC 9881 | ML-DSA-44/65/87 OIDs in X.509 |
| signatureValue bytes (3309 B) | FIPS 204 | ML-DSA signing (CA side) |
| CMP IR/IP envelope + encrCert POP | RFC 9810 | CMP Updates for KEM (2025-07) |
| Downstream: same cert in S/MIME | RFC 9936 | ML-KEM in CMS (2026-03) |
Try it
Why does the ML-KEM key update use an encrypted-certificate proof of possession?
Next step
Turn it into a plan: Hybrid Transition PlannerThis tool practises the PKI Enrollment Protocols (EST & CMP) module, phase 5 (Pilots & Migration); Hybrid Transition Planner produces a deliverable of that phase.
Related content
Next in OpenSSL Studio