update est docs

docs/documentation/platform/pki/enrollment-methods/est.mdx

@@ -14,8 +14,8 @@ Infisical's EST service is based on [RFC 7030](https://datatracker.ietf.org/doc/
 - **simpleenroll** - allows an EST client to request a new certificate from Infisical's EST server
 - **simplereenroll** - similar to the /simpleenroll endpoint but is used for renewing an existing certificate.
 
-These endpoints are exposed on port 8443 under the .well-known/est path (e.g.
+These EST endpoints are exposed on port 8443 under the .well-known/est path
-`https://app.infisical.com:8443/.well-known/est/:estLabel/cacerts`).
+and structured under `https://app.infisical.com:8443/.well-known/est/{profile_id}/...`
 
 ## Prerequisites
 
@@ -36,6 +36,8 @@ In the following steps, we explore how to issue a X.509 certificate using the ES
     Create a [certificate
     profile](/documentation/platform/pki/certificates/profiles) with **EST**
     selected as the enrollment method and fill in EST-specific configuration.
+    
+  ![pki est config](/images/platform/pki/enrollment-methods/est/est-config.png)
 
     Here's some guidance on each EST-specific configuration field:
 
@@ -43,17 +45,18 @@ In the following steps, we explore how to issue a X.509 certificate using the ES
     - EST Passphrase: This is also used to authenticate your devices with Infisical's EST server. When configuring the clients, use the value defined here as the EST password.
     - CA Chain Certificate: This is the certificate chain used to validate your devices' manufacturing/pre-installed certificates. This will be used to authenticate your devices with Infisical's EST server.
 
-    Note that forsecurity reasons, Infisical authenticates EST clients using both client certificate and passphrase.
-
   </Step>
   <Step title="Obtain the EST label">
-    Once the configuration of enrollment options is completed, a new EST Label field will appear in the enrollment settings. This is the value to use as label in the URL when configuring the connection of EST clients to Infisical.
+    Once the EST enrollment method configuration is complete, you can use the ID of the associated certificate profile
+    `profile_id` as the EST label when enrolling EST clients with Infisical.
+    
+    ![pki est label](/images/platform/pki/enrollment-methods/est/est-label.png)
 
-       The complete URL of the supported EST endpoints may look like the following:
+    The complete URL structure of the supported EST endpoints may look like the following:
 
-        - https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/cacerts
+    - https://app.infisical.com:8443/.well-known/est/{profile_id}/cacerts
-        - https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/simpleenroll
+    - https://app.infisical.com:8443/.well-known/est/{profile_id}/simpleenroll
-        - https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/simplereenroll
+    - https://app.infisical.com:8443/.well-known/est/{profile_id}/simplereenroll
     </Step>
 
     <Step title="Configure EST clients">

docs/documentation/platform/pki/overview.mdx

@@ -16,4 +16,4 @@ Core capabilities include:
 - Certificate Inventory: Track and monitor issued X.509 certificates, maintaining a comprehensive inventory of all active and expired certificates.
 - Certificate Lifecycle Automation: Automate issuance, [renewal](/documentation/platform/pki/certificates/certificates#guide-to-renewing-certificates), and [revocation](/documentation/platform/pki/certificates/certificates#guide-to-revoking-certificates) with policy-based workflows, ensuring certificates remain valid, compliant, and up to date across your infrastructure.
 - [Certificate Syncs](/documentation/platform/pki/certificate-syncs/overview): Push certificates to cloud certificate managers like [AWS Certificate Manager](/documentation/platform/pki/certificate-syncs/aws-certificate-manager) and [Azure Key Vault](/documentation/platform/pki/certificate-syncs/azure-key-vault).
-- [Certificate Alerts](/documentation/platform/pki/alerting): Receive real-time alerts and webhook events for certificate lifecycle changes such as certificate expiration.
+- [Certificate Alerts](/documentation/platform/pki/alerting): Receive alerts and webhook events for certificate lifecycle changes such as certificate expiration.