# eSIM ES interfaces — ES2+, ES8+, ES9+, ES10 explained

> The eSIM ecosystem is held together by a set of ES (eSIM) interfaces defined in GSMA SGP.22 (consumer) and SGP.32 (IoT). Each ES interface specifies who talks to whom, what they exchange, and how it is secured. ES2+ is operator-to-SM-DP+. ES8+ is SM-DP+-to-eUICC over the air. ES9+ is LPA-to-SM-DP+ over HTTPS. ES10 is LPA-to-eUICC inside the device. Knowing these is the difference between reading the spec and reading hieroglyphs.

- Canonical URL: https://www.broadnet.me/answers/esim-es-interfaces-explained
- Language: en
- Last reviewed: 2026-05-28
- Publisher: BroadNet (https://www.broadnet.me)

## ES2+ — operator to SM-DP+

ES2+ is the back-office interface the operator uses to tell the SM-DP+ to prepare a profile for a specific EID: "Generate a profile from template X, bind it to EID Y, and queue it for download." It also handles status callbacks (profile downloaded, profile installed, profile enabled). ES2+ is typically REST/HTTPS, secured by mTLS between operator BSS/OSS and SM-DP+. For most operators this is the only ES interface their own engineering team ever touches; everything else is between vendor components.

## ES8+ — SM-DP+ to eUICC over the air

ES8+ is the cryptographic protocol that delivers the actual profile content from the SM-DP+ to the eUICC's ISD-P, end-to-end encrypted. The payload is structured per SGP.22 with PSK-TLS or RSP-Session-Key-derived encryption; intermediate network nodes (LPA, device OS, network) see only opaque ciphertext. ES8+ is the part of the spec that makes "profile injection" attacks infeasible — even a fully-compromised LPA cannot read the profile in transit.

## ES9+ — LPA to SM-DP+ over HTTPS

ES9+ is the device-side HTTPS endpoint the Local Profile Assistant calls to initiate a profile download: "Hello SM-DP+, I am EID X with this challenge, please prepare and send the profile." Authentication uses GSMA CI-rooted certificates on both sides. ES9+ is what fails when a device cannot reach the internet, or when corporate proxies break TLS interception — most consumer profile-download failures trace back to ES9+ connectivity.

## ES10 — LPA to eUICC inside the device

ES10 is the local interface between the Local Profile Assistant (running in the device OS) and the eUICC chip, over the device's internal SIM bus. ES10a/b/c are sub-interfaces for different operations (download, install, enable/disable, list). ES10 is the one most users notice when it breaks — "Could not install eSIM" on the device almost always means an ES10 failure on the LPA side. BroadNet's eSIM VSM platform (/operators/esim-vsm) ships test vectors that exercise all four ES interfaces during operator onboarding.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is Remote SIM Provisioning (RSP)?](https://www.broadnet.me/answers/what-is-remote-sim-provisioning)
- [SM-DP+ — Subscription Manager Data Preparation, explained](https://www.broadnet.me/answers/sm-dp-plus)
- [SM-DS — Subscription Manager Discovery Service](https://www.broadnet.me/answers/sm-ds)
- [eUICC — the embedded UICC chip explained](https://www.broadnet.me/answers/what-is-euicc)
- [eUICC security domains — ISD-R, ISD-P, MNO-SD, ECASD](https://www.broadnet.me/answers/euicc-security-domains)
- [SGP.32 — eSIM IoT for M2M without the SM-DP+ dance](https://www.broadnet.me/answers/sgp-32-esim)
- [eSIM VSM platform](https://www.broadnet.me/operators/esim-vsm)