Security Tools › PKI & Certificates › Protocols & APIs
Protocols and APIs
See how ACME, SCEP, EST, OCSP and CAA fit together; build the exact OCSP request for a certificate and read the responder’s answer; prepare EST endpoints and commands; and write CAA records.
- 5 free tools
- Nothing uploaded or stored
- OCSP · EST · CAA
Protocols & APIs
How certificates are requested, issued, constrained and checked — with decoders, builders and ready-to-run commands.
How the protocols fit together
CAA record builder RFC 8659 · RFC 8657 New
CAA records tell certificate authorities which of them may issue for your domain. Public CAs must check them before every issuance. Optionally lock issuance to your own ACME account and validation method.
EST helper Enrollment over Secure Transport · RFC 7030 New
EST enrols devices and servers over HTTPS. Build the endpoint URLs and commands for your server, and decode the base64 responses it returns.
Endpoints and commands
Decode an EST response
ACME & SCEP platform support From vendor documentation
Which protocols common certificate platforms offer, according to each vendor's own documentation (checked October 2026). This is not a CSMIC certification or integration test: use the runners above against your own deployment.
| Platform | ACME | SCEP | Notes | Source |
|---|---|---|---|---|
| Smallstep step-ca | ✔ Yes | ✔ Yes | Private ACME server for internal PKI; SCEP through a SCEP provisioner. | smallstep.com |
| CyberArk Certificate Manager – Self-Hosted (formerly Venafi TLS Protect) | ✔ Yes | ✔ Yes | "ACME Service" and "Network Device Enrollment" (SCEP) components; EST is also offered. | docs.venafi.com |
| AppViewX CLM | ✔ Yes | ✔ Yes | Also EST, CMP, WAEP and Microsoft Intune. | docs.appviewx.com |
| Microsoft AD CS | ✖ Not built in | ✔ Yes (NDES) | SCEP through the Network Device Enrollment Service role. AD CS has no ACME role service; ACME needs a third-party add-on. | learn.microsoft.com |
Product names change: Venafi is now part of CyberArk. Features can depend on edition, version and licensing — confirm with the vendor.
OCSP request builder & response analyser RFC 6960 New
Build the exact OCSP request for a certificate, then paste the responder's answer to see the status and check its signature. Some public CAs, including Let's Encrypt (2025), have stopped running OCSP and publish CRLs instead — use the CRL checker for those.