RFC 9908: Clarification and Enhancement of the CSR Attributes Definition in RFC 7030
In plain English — editorial summary, not part of the RFC
This document updates RFC 7030, "Enrollment over Secure Transport" (EST), clarifying how the Certificate Signing Request (CSR) Attributes Response can be used by an EST server to specify both CSR attribute Object Identifiers (OIDs) and CSR attribute values, particularly X.509 extension values, that the server expects the client to include in a subsequent CSR request. RFC 9148 is derived from RFC 7030 and is also updated. RFC 7030 is ambiguous in its specification of the CSR Attributes Response. This has resulted in implementation challenges and implementor confusion because there was no universal understanding of what was specified. This document clarifies the encoding rules. This document also provides a new straightforward approach: using a template for CSR contents that may be partially filled in by the server. This also allows an EST server to specify a subject Distinguished Name (DN).
Document record
- Document ID
- RFC9908
- Published
- January 2026
- Authors
- M. Richardson; O. Friel; D. von Oheimb; D. Harkins
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- sec
- Pages
- 22
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 10031Media Access Control (MAC) Addresses in X.509 CertificatesCurrent
August 2026
- RFC 5280Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) ProfileUpdated
May 2008
- RFC 4683Internet X.509 Public Key Infrastructure Subject Identification Method (SIM)Current
October 2006
- RFC 7143Internet Small Computer System Interface (iSCSI) Protocol (Consolidated)Current
April 2014
- RFC 6688Parallel NFS (pNFS) Block Disk ProtectionCurrent
July 2012
- RFC 9909Internet X.509 Public Key Infrastructure -- Algorithm Identifiers for the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA)Current
December 2025
- RFC 9901Selective Disclosure for JSON Web TokensCurrent
November 2025
- RFC 9919The Lightweight Online Certificate Status Protocol (OCSP) Profile for High-Volume EnvironmentsCurrent
July 2026
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?