node-red-contrib-tp

Node-RED nodes for certificate enrollment via Trustpoint's EST (Enrollment over Secure Transport) protocol.

Features

✅ Flexible Enrollment: Support for both direct enrollment and two-step onboarding workflows
✅ EST Protocol: Full EST protocol implementation per RFC 7030
✅ Domain Credentials: Onboarding workflow with domain credential and application certificates
✅ Certificate Management: Generate keys, create CSRs, and manage certificates
✅ Secure: TLS/mTLS support with configurable trust stores

Installation

npm install node-red-contrib-tp

Or install directly via the Node-RED palette manager.

Trustpoint EST Workflows

Certificate Enrollment

Trustpoint uses EST (Enrollment over Secure Transport) protocol. The certificate type is determined by the certificate profile in the EST path:

https://<hostname>/.well-known/est/<realm>/<certificate-profile>/simpleenroll

Examples:

TLS Client Certificate: .../arburg/tls-client/simpleenroll
Domain Credential: .../arburg/domaincredential/simpleenroll
No Profile: .../arburg/simpleenroll

1. Single-Step Enrollment (Username/Password)

Enroll any type of certificate using username/password authentication:

curl --user "ALLROUNDER-Injection-Molding-Machine:wMJWF8gJC6q8iXDF" \
  --cacert trustpoint-tls-trust-store.pem \
  --header "Content-Type: application/pkcs10" \
  --data-binary "@csr-0.der" \
  -o certificate-0.der \
  https://127.0.0.1:443/.well-known/est/arburg/tls-client/simpleenroll

Node-RED Flow:

generate-keys → Generate key pair
create-csr → Create certificate signing request
enroll-pkcs10 → Enroll certificate (specify profile: "tls-client")
store-certificate → Store the certificate

2. Two-Step Onboarding (Domain Credential + mTLS)

For secure onboarding, first get a domain credential, then use it for mTLS authentication:

Step 1: Enroll Domain Credential

curl --user "device-id:onboarding-password" \
  --cacert trustpoint-tls-trust-store.pem \
  --header "Content-Type: application/pkcs10" \
  --data-binary "@csr-domain-credential.der" \
  -o domain-credential-certificate.der \
  https://127.0.0.1:443/.well-known/est/arburg/domaincredential/simpleenroll/

Node-RED Flow:

generate-keys → Generate keys for domain credential
create-csr → Create CSR
enroll-domain-credential → Enroll with username/password (profile: "domaincredential")
Store the private key

Step 2: Enroll Application Certificate

curl --cert domain-credential-certificate.pem \
  --key domain-credential-key.pem \
  --cacert trustpoint-tls-trust-store.pem \
  --header "Content-Type: application/pkcs10" \
  --data-binary "@csr-application.der" \
  -o application-certificate.der \
  https://127.0.0.1:443/.well-known/est/arburg/tls-client/simpleenroll/

Node-RED Flow:

generate-keys → Generate keys for application certificate
create-csr → Create CSR
enroll-application-cert → Enroll with mTLS (domain credential)
store-certificate → Store application certificate

Available Nodes

Configuration Nodes

`trustpoint-config`

Configuration node for Trustpoint EST endpoints.

Configuration Example:

{
  "hostname": "https://127.0.0.1:443",
  "est_path": "/.well-known/est/arburg",
  "subjects": [
    {
      "property": "CN",
      "prop_value": "",
      "prop_required": true,
      "prop_modifiable": true
    },
    {
      "property": "O",
      "prop_value": "My Organization",
      "prop_required": false,
      "prop_modifiable": true
    }
  ],
  "subject_alternative_names": []
}

Enrollment Nodes

`enroll-domain-credential`

Enrolls a domain credential certificate using username/password authentication. This is the first step in the onboarding workflow.

Inputs:

msg.trustpoint.csr - Certificate Signing Request (PEM format)
Username and password (configured or from message)

Outputs:

msg.trustpoint.domain_credential.certificate - Certificate (base64)
msg.trustpoint.domain_credential.certificate_pem - Certificate (PEM format)
msg.trustpoint.domain_credential.serial_number - Certificate serial number
msg.trustpoint.domain_credential.subject - Certificate subject DN
msg.trustpoint.domain_credential.issuer - Certificate issuer DN
msg.trustpoint.domain_credential.valid_from - Validity start date
msg.trustpoint.domain_credential.valid_to - Validity end date

`enroll-application-cert`

Enrolls an application certificate using a domain credential certificate for mTLS authentication. This is the second step in the onboarding workflow.

Inputs:

msg.trustpoint.csr - Certificate Signing Request (PEM format)
msg.trustpoint.domain_credential.certificate_pem - Domain credential certificate
msg.trustpoint.domain_key - Private key for domain credential

Outputs:

msg.trustpoint.application_cert.certificate - Certificate (base64)
msg.trustpoint.application_cert.certificate_pem - Certificate (PEM format)
msg.trustpoint.application_cert.serial_number - Certificate serial number
msg.trustpoint.application_cert.subject - Certificate subject DN
msg.trustpoint.application_cert.issuer - Certificate issuer DN
msg.trustpoint.application_cert.valid_from - Validity start date
msg.trustpoint.application_cert.valid_to - Validity end date

`enroll-pkcs10`

Enrolls a certificate using username/password authentication. The certificate type is determined by the certificate profile parameter.

Inputs:

cert_profile - Certificate profile name (e.g., "tls-client", "domaincredential", or empty for base path)
msg.trustpoint.csr - Certificate Signing Request (PEM format)
Username and password (configured or from message)

Outputs:

msg.trustpoint.enroll_pkcs10.certificate - Certificate (base64)
msg.trustpoint.enroll_pkcs10.certificate_pem - Certificate (PEM format)
msg.trustpoint.enroll_pkcs10.serial_number - Certificate serial number
msg.trustpoint.enroll_pkcs10.subject - Certificate subject DN
msg.trustpoint.enroll_pkcs10.issuer - Certificate issuer DN
msg.trustpoint.enroll_pkcs10.valid_from - Validity start date
msg.trustpoint.enroll_pkcs10.valid_to - Validity end date

Example:

// Enroll TLS client certificate
cert_profile: "tls-client"
// Results in EST URL: https://127.0.0.1/.well-known/est/arburg/tls-client/simpleenroll

// Enroll domain credential
cert_profile: "domaincredential"
// Results in EST URL: https://127.0.0.1/.well-known/est/arburg/domaincredential/simpleenroll

Key and Certificate Management Nodes

`generate-keys`

Generates an RSA or EC key pair.

Outputs:

msg.trustpoint.privateKey - Private key (PEM format)
msg.trustpoint.publicKey - Public key (PEM format)

`create-csr`

Creates a PKCS#10 Certificate Signing Request.

Inputs:

msg.trustpoint.privateKey - Private key
Subject DN fields (configured or from message)

Outputs:

msg.trustpoint.csr - Certificate Signing Request (PEM format)

`store-certificate`

Stores a certificate to file or message context.

`export-keys`

Exports keys in various formats.

`generate-p12`

Generates a PKCS#12 keystore containing certificate and private key.

Certificate Operations

`revocation-status`

Checks the revocation status of a certificate via OCSP.

`revoke`

Revokes a certificate.

`search-certificates`

Searches for certificates in the Trustpoint system.

Example Flows

Simple Enrollment Flow (TLS Client Certificate)

[
  {
    "id": "generate-keys-node",
    "type": "generate-keys",
    "name": "Generate Keys",
    "keySize": 2048,
    "keyType": "RSA"
  },
  {
    "id": "create-csr-node",
    "type": "create-csr",
    "name": "Create CSR",
    "subject": {
      "CN": "ALLROUNDER-Injection-Molding-Machine"
    }
  },
  {
    "id": "enroll-node",
    "type": "enroll-pkcs10",
    "name": "Enroll TLS Client Certificate",
    "trustpointConfig": "trustpoint-config-id",
    "cert_profile": "tls-client",
    "username": "ALLROUNDER-Injection-Molding-Machine",
    "password": "wMJWF8gJC6q8iXDF"
  }
]

Domain Credential Enrollment

[
  {
    "id": "gen-domain-keys",
    "type": "generate-keys",
    "name": "Generate Domain Keys"
  },
  {
    "id": "create-domain-csr",
    "type": "create-csr",
    "name": "Create Domain CSR"
  },
  {
    "id": "enroll-domain",
    "type": "enroll-pkcs10",
    "name": "Enroll Domain Credential",
    "cert_profile": "domaincredential",
    "username": "device-id",
    "password": "onboarding-password"
  }
]

Two-Step Onboarding Flow

[
  {
    "id": "gen-domain-keys",
    "type": "generate-keys",
    "name": "Generate Domain Keys"
  },
  {
    "id": "create-domain-csr",
    "type": "create-csr",
    "name": "Create Domain CSR"
  },
  {
    "id": "enroll-domain",
    "type": "enroll-domain-credential",
    "name": "Enroll Domain Credential (Step 1)"
  },
  {
    "id": "gen-app-keys",
    "type": "generate-keys",
    "name": "Generate App Keys"
  },
  {
    "id": "create-app-csr",
    "type": "create-csr",
    "name": "Create App CSR"
  },
  {
    "id": "enroll-app",
    "type": "enroll-application-cert",
    "name": "Enroll Application Certificate (Step 2)"
  }
]

TLS Configuration

All enrollment nodes require a TLS configuration node. This specifies the CA certificate to trust when connecting to the Trustpoint server.

Add a tls-config node
Specify the CA certificate for your Trustpoint server
Reference this configuration in your enrollment nodes

Migration from EJBCA

If you're migrating from the node-red-contrib-ejbca package:

Configuration: Replace ejbca-config-3 with trustpoint-config
Direct Enrollment: enroll-pkcs10 now uses EST instead of REST API
New Workflows: Take advantage of the new onboarding workflow nodes
Message Properties: Update from msg.ejbca.* to msg.trustpoint.*

Security Considerations

TLS Certificates: Always use proper TLS configuration with valid CA certificates
Credentials: Use Node-RED credentials for storing sensitive passwords
Key Storage: Private keys are stored in message context - consider using secure storage
Onboarding: Use the two-step onboarding workflow for production deployments
Certificate Rotation: Implement certificate renewal before expiration

Development

# Clone repository
git clone https://github.com/Trustpoint-Project/node-red-contrib-tp.git
cd node-red-contrib-tp

# Install dependencies
npm install

# Link for local development
npm link
cd ~/.node-red
npm link node-red-contrib-tp

# Restart Node-RED
node-red

License

MIT

Author

Florian Handke
Email: [email protected]
GitHub: @FHatCSW

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Support

Issues: GitHub Issues
Trustpoint: Trustpoint Project

Changelog

Version 2.0.0

Migrated from EJBCA to Trustpoint
Added EST protocol support
Added onboarding workflow with domain credentials
New nodes: enroll-domain-credential, enroll-application-cert
Updated configuration structure
Improved error handling and status reporting

Name		Name	Last commit message	Last commit date
.idea		.idea
examples		examples
lib		lib
ARCHITECTURE.md		ARCHITECTURE.md
Dockerfile		Dockerfile
IMPLEMENTATION_SUMMARY.md		IMPLEMENTATION_SUMMARY.md
LICENSE		LICENSE
MIGRATION.md		MIGRATION.md
README.md		README.md
docker-compose.yml		docker-compose.yml
docker_copy.sh		docker_copy.sh
docker_rebuild.sh		docker_rebuild.sh
package-lock.json		package-lock.json
package.json		package.json

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

node-red-contrib-tp

Features

Installation

Trustpoint EST Workflows

Certificate Enrollment

1. Single-Step Enrollment (Username/Password)

2. Two-Step Onboarding (Domain Credential + mTLS)

Available Nodes

Configuration Nodes

trustpoint-config

Enrollment Nodes

enroll-domain-credential

enroll-application-cert

enroll-pkcs10

Key and Certificate Management Nodes

generate-keys

create-csr

store-certificate

export-keys

generate-p12

Certificate Operations

revocation-status

revoke

search-certificates

Example Flows

Simple Enrollment Flow (TLS Client Certificate)

Domain Credential Enrollment

Two-Step Onboarding Flow

TLS Configuration

Migration from EJBCA

Security Considerations

Development

License

Author

Contributing

Support

Changelog

Version 2.0.0

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`trustpoint-config`

`enroll-domain-credential`

`enroll-application-cert`

`enroll-pkcs10`

`generate-keys`

`create-csr`

`store-certificate`

`export-keys`

`generate-p12`

`revocation-status`

`revoke`

`search-certificates`