go-ces

module

v0.0.0-...-4cc0a05 Latest Latest Go to latest Published: Jul 7, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Exonical/go-ces

Links

Open Source Insights

README ¶

go-ces

Go implementation of the Windows Certificate Enrollment Web Services:

CEP — Certificate Enrollment Policy Web Service (MS-XCEP)
CES — Certificate Enrollment Web Service (MS-WSTEP)

These protocols allow Windows clients to discover available certificate templates and enroll for X.509 certificates over HTTPS/SOAP, enabling autoenrollment scenarios without direct DCOM/RPC access to a Microsoft CA.

Architecture

Windows Client
   │
   ├─► CEP (MS-XCEP): "What templates/CAs are available?"
   │        └─► GetPoliciesResponse
   │
   └─► CES (MS-WSTEP): "Sign this CSR for template X"
            └─► RequestSecurityTokenResponse (cert or pending)

The server exposes two SOAP endpoints backed by pluggable interfaces:

backend.PolicyProvider — supplies enrollment policies (templates, CAs, OIDs)
backend.Signer — handles CSR enrollment, polling, and renewal

Any CA can be used as a backend by implementing these interfaces.

Quick Start

go install github.com/Exonical/go-ces/cmd/go-ces-server@latest

See docs/deployment.md for configuration and deployment examples.

Project Structure

pkg/soap/       SOAP 1.2 envelope, fault, WS-Addressing helpers
pkg/cep/        CEP (MS-XCEP) handler and message types
pkg/ces/        CES (MS-WSTEP) handler and message types
pkg/auth/       Authentication middleware (UsernameToken, TLS, Kerberos)
backend/        Signer/PolicyProvider interfaces + implementations
cmd/            Standalone server binary

Authentication

Windows CES/CEP supports three modes (URL-path-based):

Username/Password — WS-Security UsernameToken
Client Certificate — mutual TLS
Kerberos/SPNEGO — HTTP Negotiate (enterprise AD)

License

MIT

Directories ¶

Path	Synopsis
backend Package backend defines the pluggable interfaces for CA backends that power the CEP and CES protocol handlers.	Package backend defines the pluggable interfaces for CA backends that power the CEP and CES protocol handlers.
mock Package mock provides an in-memory mock implementation of the backend interfaces for testing.	Package mock provides an in-memory mock implementation of the backend interfaces for testing.
smallstep Package smallstep implements a backend.Signer that delegates certificate signing to a Smallstep CA (step-ca) instance via its REST API.	Package smallstep implements a backend.Signer that delegates certificate signing to a Smallstep CA (step-ca) instance via its REST API.
cmd
go-ces-server command go-ces-server is a standalone Certificate Enrollment Web Services server implementing MS-XCEP (CEP) and MS-WSTEP (CES) protocols.	go-ces-server is a standalone Certificate Enrollment Web Services server implementing MS-XCEP (CEP) and MS-WSTEP (CES) protocols.
pkg
auth Package auth provides authentication middleware for the CEP/CES endpoints.	Package auth provides authentication middleware for the CEP/CES endpoints.
cep Package cep implements the Certificate Enrollment Policy Web Service (MS-XCEP) protocol handler.	Package cep implements the Certificate Enrollment Policy Web Service (MS-XCEP) protocol handler.
ces Package ces implements the Certificate Enrollment Web Service (MS-WSTEP) protocol handler.	Package ces implements the Certificate Enrollment Web Service (MS-WSTEP) protocol handler.
soap Package soap provides SOAP 1.2 envelope marshaling/unmarshaling helpers for the MS-XCEP and MS-WSTEP protocols.	Package soap provides SOAP 1.2 envelope marshaling/unmarshaling helpers for the MS-XCEP and MS-WSTEP protocols.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL