# Using ansible for Enrollment over Secure Transport

**URL:** <https://forum.ansible.com/t/using-ansible-for-enrollment-over-secure-transport/45398>\
**Category:** Get Help\
**Created:** [February 24, 2026, 4:43pm UTC](https://forum.ansible.com/t/using-ansible-for-enrollment-over-secure-transport/45398 "2026-02-24T16:43:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mariolenz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mariolenz/32/108_2.png) [@mariolenz](https://forum.ansible.com/u/mariolenz)\
**Post date:** [February 24, 2026, 4:43pm UTC](https://forum.ansible.com/t/using-ansible-for-enrollment-over-secure-transport/45398/1 "2026-02-24T16:43:14Z")

</div>

I’m having a look at [Enrollment over Secure Transport](https://en.wikipedia.org/wiki/Enrollment_over_Secure_Transport) (EST) as a way to get certificates for devices that are not supporting [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment), or at least not yet. The use case would be to get or at least renew a certificate for a device from a management system. As far as I understand, this would be possible with EST. Well, probably not getting a certificate but renewing one.

While I’m trying to understand the protocol, I’d like to ask around here in parallel if anyone is using EST with Ansible yet. I think you can do it someway more or less using the uri module only. But maybe there’s a better way, like a role or even a module implementing this. I only found [this](https://github.com/EtneteraLogicworks/ansible-estclient), which is 5 years old so I’m not sure if it’s really up to date or even still working.

Would be great to get some help there, or even some helpful information or suggestions 😃

---

<div class="post-metadata">

**Author:** ![markuman](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@markuman](https://forum.ansible.com/u/markuman)\
**Post date:** [February 26, 2026, 3:53pm UTC](https://forum.ansible.com/t/using-ansible-for-enrollment-over-secure-transport/45398/2 "2026-02-26T15:53:12Z")

</div>

> [@mariolenz](#):
>
> The use case would be to get

I’m not sure if this will also solve your use case,  
but getting certificates is basically easy using `community.crypto.openssl_csr` and `community.crypto.acme_certificate` (_Regardless of whether the device supports ACME or not_).  
We use them to create new Let’s Encrypt wildcard certificates weekly.  
To get it done unattended, it’s also necessary to set the challenge as a TXT record in your DNS (_with community.dns, community.aws …or whereever your domain is hosted_).

---

<div class="post-metadata">

**Author:** ![mariolenz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mariolenz/32/108_2.png) [@mariolenz](https://forum.ansible.com/u/mariolenz)\
**Post date:** [February 26, 2026, 4:32pm UTC](https://forum.ansible.com/t/using-ansible-for-enrollment-over-secure-transport/45398/3 "2026-02-26T16:32:36Z")

</div>

Maybe I should give some additional information here.

We’re having a lot of physical servers, and we want to get certificates for the _hardware_ (BMC). That’s supported using ACME, but only simple and plain HTTP challenge. Our internal PKI requires External Account Binding (EAB) for whatevers reasons. Our servers don’t implement this. And as far as I understand, EAB requires to POST some additional data. So you can’t encode this in the URL.

So I thought EST might be a solution.

I’ll have to ask around if our internal PKI also allows DNS challenge. If yes, and `community.crypto.acme_certificate` implements EAB, and we get permissions to create DNS entries this might also be a way.

There are a lot of “ands”, but thanks for giving me ideas @markuman!