Skip to content

Commit 7be7142

Browse files
marainomaraino
authored
Merge branch 'master' into AuthParams
2 parents 8e4c5d7 + f0e3653 commit 7be7142

File tree

15 files changed

+832
-437
lines changed

15 files changed

+832
-437
lines changed

‎command/ca/provisioner/add.go‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ func addCommand() cli.Command {
3434
[**--admin-cert**=<file>] [**--admin-key**=<file>]
3535
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
3636
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
37+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
38+
[**--ssh-template-data**=<file>]
3739
3840
ACME
3941
@@ -43,6 +45,7 @@ ACME
4345
[**--admin-cert**=<file>] [**--admin-key**=<file>]
4446
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
4547
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
48+
[**--x509-template**=<file>] [**--x509-template-data**=<file>]
4649
4750
OIDC
4851
@@ -53,13 +56,17 @@ OIDC
5356
[**--admin-cert**=<file>] [**--admin-key**=<file>]
5457
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
5558
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
59+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
60+
[**--ssh-template-data**=<file>]
5661
5762
X5C
5863
5964
**step ca provisioner add** <name> **--type**=X5C **--x5c-roots**=<file>
6065
[**--admin-cert**=<file>] [**--admin-key**=<file>]
6166
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
6267
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
68+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
69+
[**--ssh-template-data**=<file>]
6370
6471
SSHPOP
6572
@@ -75,14 +82,15 @@ Nebula
7582
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
7683
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
7784
78-
K8SSA
85+
K8SSA (Kubernetes Service Account)
7986
8087
**step ca provisioner add** <name> **--type**=K8SSA [**--public-key**=<file>]
8188
[**--admin-cert**=<file>] [**--admin-key**=<file>]
8289
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
8390
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
91+
[**--x509-template**=<file>] [**--x509-template-data**=<file>]
8492
85-
IID
93+
IID (AWS/GCP/Azure)
8694
8795
**step ca provisioner add** <name> **--type**=[AWS|Azure|GCP]
8896
[**--aws-account**=<id>] [**--gcp-service-account**=<name>] [**--gcp-project**=<name>]
@@ -93,6 +101,8 @@ IID
93101
[**--admin-cert**=<file>] [**--admin-key**=<file>]
94102
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
95103
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
104+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
105+
[**--ssh-template-data**=<file>]
96106
97107
SCEP
98108
@@ -103,7 +113,8 @@ SCEP
103113
[**--scep-decrypter-key-uri**=<uri>] [**--scep-decrypter-key-password-file**=<file>]
104114
[**--admin-cert**=<file>] [**--admin-key**=<file>] [**--admin-subject**=<subject>]
105115
[**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
106-
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]`,
116+
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
117+
[**--x509-template**=<file>] [**--x509-template-data**=<file>]`,
107118
Flags: []cli.Flag{
108119
// General provisioner flags
109120
typeFlag,

‎command/ca/provisioner/update.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ func updateCommand() cli.Command {
3333
[**--admin-cert**=<file>] [**--admin-key**=<file>] [**--admin-subject**=<subject>]
3434
[**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
3535
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
36+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
37+
[**--ssh-template-data**=<file>]
3638
3739
ACME
3840
@@ -42,6 +44,7 @@ ACME
4244
[**--attestation-roots**=<file>] [**--admin-cert**=<file>] [**--admin-key**=<file>]
4345
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
4446
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
47+
[**--x509-template**=<file>] [**--x509-template-data**=<file>]
4548
4649
OIDC
4750
@@ -56,20 +59,25 @@ OIDC
5659
[**--admin-cert**=<file>] [**--admin-key**=<file>]
5760
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
5861
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
62+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
63+
[**--ssh-template-data**=<file>]
5964
6065
X5C
6166
6267
**step ca provisioner update** <name> **--x5c-roots**=<file>
6368
[**--admin-cert**=<file>] [**--admin-key**=<file>]
6469
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
6570
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
71+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
72+
[**--ssh-template-data**=<file>]
6673
6774
K8SSA (Kubernetes Service Account)
6875
6976
**step ca provisioner update** <name> [**--public-key**=<file>]
7077
[**--admin-cert**=<file>] [**--admin-key**=<file>]
7178
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
7279
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
80+
[**--x509-template**=<file>] [**--x509-template-data**=<file>]
7381
7482
IID (AWS/GCP/Azure)
7583
@@ -84,6 +92,8 @@ IID (AWS/GCP/Azure)
8492
[**--admin-cert**=<file>] [**--admin-key**=<file>]
8593
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
8694
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
95+
[**--x509-template**=<file>] [**--x509-template-data**=<file>] [**--ssh-template**=<file>]
96+
[**--ssh-template-data**=<file>]
8797
8898
SCEP
8999
@@ -94,7 +104,8 @@ SCEP
94104
[**--scep-decrypter-key-uri**=<uri>] [**--scep-decrypter-key-password-file**=<file>]
95105
[**--admin-cert**=<file>] [**--admin-key**=<file>] [**--admin-subject**=<subject>]
96106
[**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
97-
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]`,
107+
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
108+
[**--x509-template**=<file>] [**--x509-template-data**=<file>]`,
98109
Flags: []cli.Flag{
99110
nameFlag,
100111
pubKeyFlag,

‎command/certificate/install.go‎

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
package certificate
22

33
import (
4+
"crypto/x509"
45
"fmt"
56
"strings"
67

78
"github.com/pkg/errors"
9+
"github.com/urfave/cli"
10+
811
"github.com/smallstep/certinfo"
912
"github.com/smallstep/truststore"
10-
"github.com/urfave/cli"
1113
"go.step.sm/cli-utils/command"
1214
"go.step.sm/cli-utils/errs"
1315
"go.step.sm/crypto/pemutil"
@@ -159,12 +161,12 @@ func installAction(ctx *cli.Context) error {
159161
}
160162

161163
filename := ctx.Args().Get(0)
162-
opts, err := getTruststoreOptions(ctx)
164+
cert, opts, err := getTruststoreOptions(ctx)
163165
if err != nil {
164166
return err
165167
}
166168

167-
if err := truststore.InstallFile(filename, opts...); err != nil {
169+
if err := truststore.Install(cert, opts...); err != nil {
168170
var truststoreErr *truststore.CmdError
169171
if errors.As(err, &truststoreErr) {
170172
return errors.Errorf("failed to execute \"%s\" failed with: %s",
@@ -175,10 +177,8 @@ func installAction(ctx *cli.Context) error {
175177

176178
fmt.Printf("Certificate %s has been installed.\n", filename)
177179
// Print certificate info (ignore errors)
178-
if cert, err := pemutil.ReadCertificate(filename); err == nil {
179-
if s, err := certinfo.CertificateShortText(cert); err == nil {
180-
fmt.Print(s)
181-
}
180+
if s, err := certinfo.CertificateShortText(cert); err == nil {
181+
fmt.Print(s)
182182
}
183183

184184
return nil
@@ -190,12 +190,12 @@ func uninstallAction(ctx *cli.Context) error {
190190
}
191191

192192
filename := ctx.Args().Get(0)
193-
opts, err := getTruststoreOptions(ctx)
193+
cert, opts, err := getTruststoreOptions(ctx)
194194
if err != nil {
195195
return err
196196
}
197197

198-
if err := truststore.UninstallFile(filename, opts...); err != nil {
198+
if err := truststore.Uninstall(cert, opts...); err != nil {
199199
var truststoreErr *truststore.CmdError
200200
if errors.As(err, &truststoreErr) {
201201
return errors.Errorf("failed to execute \"%s\" failed with: %s",
@@ -206,23 +206,21 @@ func uninstallAction(ctx *cli.Context) error {
206206

207207
fmt.Printf("Certificate %s has been removed.\n", filename)
208208
// Print certificate info (ignore errors)
209-
if cert, err := pemutil.ReadCertificate(filename); err == nil {
210-
if s, err := certinfo.CertificateShortText(cert); err == nil {
211-
fmt.Print(s)
212-
}
209+
if s, err := certinfo.CertificateShortText(cert); err == nil {
210+
fmt.Print(s)
213211
}
214212

215213
return nil
216214
}
217215

218-
func getTruststoreOptions(ctx *cli.Context) ([]truststore.Option, error) {
216+
func getTruststoreOptions(ctx *cli.Context) (*x509.Certificate, []truststore.Option, error) {
219217
cert, err := pemutil.ReadCertificate(ctx.Args().Get(0))
220218
if err != nil {
221-
return nil, err
219+
return nil, nil, err
222220
}
223221

224222
if !cert.IsCA || cert.CheckSignatureFrom(cert) != nil {
225-
return nil, errors.Errorf("certificate %s is not a root CA", ctx.Args().Get(0))
223+
return nil, nil, errors.Errorf("certificate %s is not a root CA", ctx.Args().Get(0))
226224
}
227225

228226
prefix := ctx.String("prefix")
@@ -251,5 +249,5 @@ func getTruststoreOptions(ctx *cli.Context) ([]truststore.Option, error) {
251249
if ctx.Bool("no-system") {
252250
opts = append(opts, truststore.WithNoSystem())
253251
}
254-
return opts, nil
252+
return cert, opts, nil
255253
}

‎command/certificate/sign.go‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ func signCommand() cli.Command {
3737
Action: cli.ActionFunc(signAction),
3838
Usage: "sign a certificate signing request (CSR)",
3939
UsageText: `**step certificate sign** <csr-file> <crt-file> <key-file>
40-
[**--profile**=<profile>] [**--template**=<file>]
41-
[**--set**=<key=value>] [**--set-file**=<file>]
40+
[**--profile**=<profile>] [**--template**=<file>]
41+
[**--set**=<key=value>] [**--set-file**=<file>] [**--omit-cn-san**]
4242
[**--password-file**=<file>] [**--path-len**=<maximum>]
4343
[**--not-before**=<time|duration>] [**--not-after**=<time|duration>]
4444
[**--bundle**]`,
@@ -79,6 +79,11 @@ Sign a CSR with custom validity and bundle the new certificate with the issuer:
7979
$ step certificate sign --bundle --not-before -1m --not-after 16h leaf.csr issuer.crt issuer.key
8080
'''
8181
82+
Sign a CSR but do not add the Common Name to the SANs extension of the certificate:
83+
'''
84+
$ step certificate sign --omit-cn-san leaf.csr issuer.crt issuer.key
85+
'''
86+
8287
Sign an intermediate ca:
8388
'''
8489
$ step certificate sign --profile intermediate-ca intermediate.csr issuer.crt issuer.key
@@ -174,6 +179,14 @@ $ step certificate sign \
174179
flags.Template,
175180
flags.TemplateSet,
176181
flags.TemplateSetFile,
182+
cli.BoolFlag{
183+
Name: "omit-cn-san",
184+
Usage: `Do not add CSR Common Name as SAN extension in resulting certificate.
185+
By default, the CSR Common Name will be added as a SAN extension only if the CSR
186+
does not contain any SANs. Note that if the Common Name is already captured as a
187+
SAN extension in the CSR then it will still appear as a SAN extension in the
188+
certificate.`,
189+
},
177190
flags.PasswordFile,
178191
cli.StringFlag{
179192
Name: "not-before",
@@ -327,7 +340,7 @@ func signAction(ctx *cli.Context) error {
327340
}
328341

329342
// Create certificate template from csr.
330-
data := createTemplateData(csr, maxPathLen)
343+
data := createTemplateData(csr, maxPathLen, ctx.Bool("omit-cn-san"))
331344
data.SetUserData(userData)
332345
tpl, err := x509util.NewCertificate(csr, x509util.WithTemplate(template, data))
333346
if err != nil {
@@ -424,7 +437,7 @@ func validateIssuer(crt *x509.Certificate, profile string, maxPathLen int) error
424437
// createTemplateData create a new template data with subject and sans based on
425438
// the information in the certificate request, and the maxPathLen for
426439
// intermediate certificates.
427-
func createTemplateData(cr *x509.CertificateRequest, maxPathLen int) x509util.TemplateData {
440+
func createTemplateData(cr *x509.CertificateRequest, maxPathLen int, omitCNSAN bool) x509util.TemplateData {
428441
var sans []string
429442
sans = append(sans, cr.DNSNames...)
430443
sans = append(sans, cr.EmailAddresses...)
@@ -435,6 +448,10 @@ func createTemplateData(cr *x509.CertificateRequest, maxPathLen int) x509util.Te
435448
sans = append(sans, v.String())
436449
}
437450

451+
if !omitCNSAN && len(sans) == 0 && cr.Subject.CommonName != "" {
452+
sans = append(sans, cr.Subject.CommonName)
453+
}
454+
438455
data := x509util.NewTemplateData()
439456
data.SetCertificateRequest(cr)
440457
data.Set("MaxPathLen", maxPathLen)

0 commit comments

Comments
 (0)