Sandelman Software Works vanderstok consultancy Cisco Systems This document defines a protocol to securely assign a pledge to a domain, represented by an EST server, using an intermediary node between pledge and EST server. This intermediary node is known as a "constrained Join Proxy". This document extends the work of [I-D.ietf-anima-bootstrapping-keyinfra] by replacing the Circuit- proxy by a stateless/stateful constrained (CoAP) Join Proxy. It transports join traffic from the pledge to the Registrar without requiring per-client state.