Help with using x509 templates in ACME type

[ghost]

Hi,
Based on the feedback we received from Issue #796, we are experimenting with using the x509 templates.

I edited the .step/config/ca.json to add the "options" section as shown below

  {
          "type": "ACME",
          "name": "acme",
          "claims": {
                  "minTLSCertDuration": "24h",
                  "maxTLSCertDuration": "2160h",
                  "defaultTLSCertDuration": "2160h"
           },
          "options": {
              "x509": {
                  "templateFile": "templates/certs/x509/default.tpl"
              }
          }
  }

The default.tpl looks like this:

{
    "subject": {{ toJson .Subject }},
    "keyUsage": ["certSign", "crlSign"],
    "basicConstraints": {
        "isCA": true,
        "maxPathLen": 1
    }
}

After I start Step-CA, when I use a step ca provisioner list command, I dont see the isCA:true set. The ACME section just has the following part:

   {
      "type": "ACME",
      "name": "acme",
      "claims": {
         "minTLSCertDuration": "24h0m0s",
         "maxTLSCertDuration": "2160h0m0s",
         "defaultTLSCertDuration": "2160h0m0s"
      }
   }

Any input on what Im missing would be greatly appreciated.

[maraino]

With a recent version of step you should see the options block too, like this:

{
    "type": "ACME",
    "name": "acme",
    "claims": {
        "minTLSCertDuration": "24h",
        "maxTLSCertDuration": "2160h",
        "defaultTLSCertDuration": "2160h"
    },
    "options": {
        "x509": {
            "templateFile": "templates/certs/x509/default.tpl"
        }
    }
}

You are not going to see the template itself.

But if you're using a recent version of step, there's a case where you will experience your problem, if you use the database to store your provisioners instead of the ca.json. This case is when enableAdmin is set to true in the ca.json. In that case changes in the ca.json won't have any effect, you should be using step beta ca provisioner <command>.

Your template default.tpl will generate an intermediate certificate that can sign other intermediate certificates, I'm not sure if that's what you want. This has also some requirements. The intermediate in the step-ca should have at least a maxPahLen of 2, and the root of 3 (or infinite, -1). But if that is what you want to create, I don't think ACME is the best provisioner to do that, as anybody in your network would be able to get an intermediate, meaning that they will be able to sign any certificate.

[gwaines]

We are using v0.14.0-rc.4-dev .
And we don't use a database to store provisioners ... believe we just use ca.json file.

So do we need to upversion to ? v0.18.0 ? to get this capability ?

[maraino]

I believe that was added in v0.15.0, but I'd recommend you upgrading to the latest version.

[ghost]

Thanks @maraino
I have installed the v0.18 and proceeding with the test. I can see the options now listed when i do a step ca provisioner list

In your comment above

The intermediate in the step-ca should have at least a maxPahLen of 2, and the root of 3 (or infinite, -1).

I have set the maxPathLen for the intermediate to 2 as advised. Where do I confirm the maxPathLen for root? I dont see it in ca.json file.

[maraino]

You can use the inspect method like:

$ step certificate inspect ~/.step/certs/root_ca.crt
...
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1

With -1 I was referring to what you have to set in a template if you want to create a root with step, see the docs of step certificate create

step certificate create --template root.tpl \
  "Acme Corporation Root CA" root_ca.crt root_ca_key