Clarification and Enhancement of the CSR Attributes Definition in RFC 7030
RFC 9908, “Clarification and Enhancement of the CSR Attributes Definition in RFC 7030”, is a Proposed Standard document published in January 2026 by M. Richardson, O. Friel, D. von Oheimb, D. Harkins. It updates RFC 7030, RFC 9148. The canonical text is published by the RFC Editor.
Abstract
This document updates RFC 7030, "Enrollment over Secure Transport" (EST), clarifying how the Certificate Signing Request (CSR) Attributes Response can be used by an EST server to specify both CSR attribute Object Identifiers (OIDs) and CSR attribute values, particularly X.509 extension values, that the server expects the client to include in a subsequent CSR request. RFC 9148 is derived from RFC 7030 and is also updated.
RFC 7030 is ambiguous in its specification of the CSR Attributes Response. This has resulted in implementation challenges and implementor confusion because there was no universal understanding of what was specified. This document clarifies the encoding rules.
This document also provides a new straightforward approach: using a template for CSR contents that may be partially filled in by the server. This also allows an EST server to specify a subject Distinguished Name (DN).
What “Proposed Standard” means
An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.
The canonical text of RFC 9908 is hosted at rfc-editor.org. Available in HTML,TXT,PDF,XML.
- RFC 9907 Guidelines for Authors and Reviewers of Documents Containing YANG Data Models
- RFC 9910 Registration Data Access Protocol Regional Internet Registry Search
- RFC 9912 Reliable and Available Wireless Architecture
- RFC 9913 Reliable and Available Wireless Technologies
- RFC 9914 Root-Initiated Routing State in the Routing Protocol for Low-Power and Lossy Networks
- RFC 9915 Dynamic Host Configuration Protocol for IPv6
- RFC 9917 IGP Flexible Algorithms Reverse Affinity Constraint
- RFC 9897 Datagram Congestion Control Protocol Extensions for Multipath Operation with Multiple Addresses