Your network gear wants SCEP. Your routers' vendor doc says EST. Can goca enroll them today? No — and you should know that before you design around it.
The role table is explicit about which heads are real:
| Head | Port | Status today |
|---|---|---|
acme | 8087 | Built and selectable |
cmp | 8082 | Listener only — answers health and its role menu, no message handler yet |
scep | 8088 | Designed, not built |
est | 8089 | Designed, not built |
Roadmap, stated plainly.
goca serve --roles accepts only the selectable names — the others fail as an unknown role, and no shipped build binds ports 8088–8091. A ScepEndpoint or EstEndpoint document will save and version today; nothing serves it. goca serve --help lists what your binary actually carries — the authority over any table, including this one.If machine enrollment can ride ACME — and more fleets can than assume they can — goca serves it today. If your device speaks only SCEP, EST or CMP, goca is not yet your enrollment path, and we would rather you hear that here than in production.
Now I know which protocol doors exist today — and which are still drawings.