How to Automate Certificates in EBO 2024 and Later Using PKI and EST

[CraigEl]

Issue

A customer asks whether it is possible to automate updating CA (Certificate Authority) certificates and automate device/server certificate renewals in EcoStruxure Building Operation (EBO) in light of the CA/Browser Forum’s phased reduction of public TLS certificate lifetimes to a maximum of 47 days by March 15, 2029. They also ask if this is already supported in EBO 2024 and later using PKI + EST (Enrollment over Secure Transport). 

Product Line

EcoStruxure Building Operation

Environment

• Building Operation Enterprise Server
• Building Operation Enterprise Central
• Building Operation Edge Server
• Building Operation Automation Servers AS‑P/AS‑B
• An enterprise PKI exposing an EST (RFC 7030) service (RA/CA).
• HTTPS/TLS communications with PEM‑formatted CA roots/intermediates for trust establishment. 

Cause

The CA/Browser Forum has approved a schedule that shortens public TLS certificate lifetimes (200 days in 2026, 100 days in 2027, and 47 days by 2029), making manual enrollment, renewal, and trust‑chain updates impractical and requiring automation to avoid service interruptions. 

EcoStruxure Building Operation supports the Enrollment over Secure Transport (EST) protocol in its PKI model. EST uses HTTPS to

1. Enroll for a certificate
2. Re‑enroll/renew an existing certificate
3. Retrieve CA (trust) certificates from the PKI.

These capabilities allow EBO servers to participate in an automated PKI environment that is compatible with short‑lived certificate ecosystems. 

Resolution

EBO 2024 (6.0) and later fully support automated PKI operations using EST. When you configure the global EST connection in PKI Settings and enable the Web Server Certificate agent for each server, EBO will automatically enroll and re-enroll certificates before they expire and will maintain CA trust through the trust anchors you provide. This ensures your BMS is prepared for the operational requirements of short-lived TLS certificates, including the 47‑day certificate lifetime that becomes mandatory in 2029.

Process Steps

1) Configure the global EST connection (one time)

1. In WorkStation, navigate to: System → Security Manager → PKI Settings → Properties → Basic. 
2. Populate the fields as defined in PKI Settings Dialog Box – Basic Tab:
   • EST server address (your PKI EST service)
   • EST server port (typically 443)
   • Trust anchor filename — PEM with CA roots/intermediates used to validate the EST server TLS session.
   • If required by your PKI, provide Username / Password or a Client certificate + Private key for EST authentication.
3. Click Save. (You can configure multiple servers using Search + Mass Editing.)

2) Enable the per‑server certificate agent

1. Navigate to: System → Security Manager → PKI Settings → Web Server Certificate → Basic.
2. Set Enabled = Yes to activate the certificate agent for that server. (Optional) Add CSR information (attribute=value pairs) if your CA policy requires it.
3. Click Save. 

3) (Optional) Manual certificate operations

• Add / activate a certificate using WorkStation, if needed for migration/testing.
• Activate / deactivate / import / export certificates on field servers using Device Administrator. 
• Review the Certificates overview for concepts and server workflows.

What happens after configuration

• Enrollment — When the certificate agent is enabled for a server, the cert-agent generates a private key and CSR and enrolls it via the configured EST connection. The issued certificate is then used for the server's HTTPS web server.
• Automatic renewal — The server re‑enrolls before expiry (when 75% of the certificate's lifetime has elapsed) using the EST re‑enrollment flow. 
• CA trust maintenance — During configuration, the agent fetches CA certificates from the EST server (/cacerts) and stores them as explicit trust anchors. These are automatically refreshed every 24 hours, ensuring the trust chain stays current as your PKI rotates CAs or intermediates. For TLS validation, the agent combines the explicit trust anchors with the initial bootstrap trust (from PKI Settings or the OS trust store) to ensure the EST server's certificate can always be verified.

Why this meets the 47‑day era

With PKI + EST configured, EBO participates in automated certificate lifecycle management aligned to the CA/B Forum schedule (200 days in 2026, 100 days in 2027, and 47 days by 2029), where automation is essential to prevent outages and maintain compliance. 

References

• Public Key Infrastructure in EBO (confirms EST support). 
• Configuring the Global Certificate Settings (navigation & mass‑edit). 
• PKI Settings Dialog Box – Basic Tab (field definitions). 
• Configuring Communication with the EST Server (per‑server Web Server Certificate).
• Web Server Certificate Dialog Box – Basic Tab (enable agent; CSR info).
• Adding a Certificate using WorkStation (optional).
• Activating/Deactivating Certificates using Device Administrator