Every device that speaks TLS needs a certificate, and getting that certificate onto the device – securely, at scale, and over its whole lifetime – is its own problem. Today we are introducing wolfCert, a new C library for client-side certificate lifecycle management built on top of wolfSSL.
What wolfCert does
wolfCert handles the full client-side certificate lifecycle for an application or device:
- Retrieve CA and trust-chain certificates from a PKI
- Generate the associated private key on the device – in software, or offloaded to secure hardware
- Build the CSR, submit it, and persist the issued certificate
- Enroll for a new end-entity certificate, and re-enroll when it is time to renew
It speaks two enrollment protocols, both over HTTP(S):
- EST (RFC 7030) – for all supported key types
- SCEP (RFC 8894) – RSA, per the specification
EST is the newer, more modern of the two – the IETF’s successor to SCEP – but plenty of deployed PKI still speaks SCEP, so wolfCert supports both.
Key generation and signing work with RSA, ECC, Ed25519, Ed448, and – notably – ML-DSA, so you can enroll post-quantum certificates today. Keys can be plain software keys, or offloaded to any HSM, TPM, PKCS#11 token, or secure element – wolfCert itself stays completely hardware-agnostic, because wolfSSL’s CryptoCb interface has already solved that offload problem. And like the rest of the wolfSSL ecosystem, it is built to run on the most constrained embedded targets, not just powerful, resource-rich devices.
The successor to wolfSCEP
Longtime users know wolfSCEP, our SCEP client for certificate enrollment. wolfCert is its successor. It keeps everything wolfSCEP did well, brings it up to the standards and algorithms of 2026, and adds a second, more modern enrollment protocol alongside SCEP. If you are using wolfSCEP today, wolfCert is where that functionality lives going forward – and a dedicated migration guide is coming.
Take a look
wolfCert is available now on GitHub at https://github.com/wolfSSL/wolfCert. The wolfcert-client CLI is the quickest way in: point it at a PKI and it will retrieve the CA chain and enroll or renew a certificate over EST or SCEP from a single command. When you are ready to build the same operations into your own application, the examples/ directory walks through the library API for EST, SCEP, and CryptoCb-backed keys.
To make that easy to try end to end, wolfCert also ships wolfcert-server: a self-contained EST/SCEP server that issues from an auto-generated local CA, so you can run a full enrollment in a couple of minutes with no external PKI to stand up. For now, the server side is meant for testing and demos rather than production, though that may change as user interest grows.
And wolfCert is built to work with the PKI you already run: we interop-test wolfCert against common EST and SCEP tools – including Smallstep’s step-ca, Cisco’s libEST, GlobalSign’s EST service, and the MicroMDM SCEP server – with more to come.
Like the rest of the wolfSSL ecosystem, wolfCert is dual-licensed: it is open source under GPLv3, with a commercial license available for teams who would rather not ship GPL-licensed code in their products.
Questions about wolfCert, certificate enrollment, or hardware-backed key storage? Contact us at facts@wolfssl.com, or call us at +1 425 245 8247. wolfSSL supports industry standards, delivers strong encryption, and offers commercial support for every product in the ecosystem.
Download wolfSSL Now