Config file seems to be ignored when using "cfssl selfsign"
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
I am trying to add a CRL to a root CA, which issue #41 suggests can now be accomplished using the "selfsign" command.
However, it seems to ignore the entire contents of my config file. If my config file is malformed, it will throw an error, but it is disregarding the entire contents.
For a given **rootca_csr.json**
```
{
"CN": "My Root CA",
"key": {
"algo": "ecdsa",
"size": 384
},
"names": [
{
"C": "US",
"O": "My Company"
}
],
"ca": {
"expiry": "262800h"
}
}
```
And a given **rootca_config.json**
```
{
"signing": {
"default": {
"crl_url": "http://my.site/root.crl",
"usages": [
"signing",
"key encipherment",
"cert sign",
"crl sign"
],
"expiry": "262800h",
"ca_constraint": {
"is_ca": true,
"max_path_len": 0,
"max_path_len_zero": true
}
}
}
}
```
And the given command:
`cfssl selfsign -config="rootca_config.json" -loglevel=0 "My Root CA" rootca_csr.json | cfssljson -bare rootca`
I get this:
> 2018/05/01 19:51:02 [DEBUG] loading configuration file from rootca_config.json
> 2018/05/01 19:51:02 [DEBUG] parse expiry in profile
> 2018/05/01 19:51:02 [DEBUG] expiry is valid
> 2018/05/01 19:51:02 [DEBUG] validating configuration
> 2018/05/01 19:51:02 [DEBUG] validate local profile
> 2018/05/01 19:51:02 [DEBUG] profile is valid
> 2018/05/01 19:51:02 [DEBUG] configuration ok
> 2018/05/01 19:51:02 [INFO] generate received request
> 2018/05/01 19:51:02 [INFO] received CSR
> 2018/05/01 19:51:02 [INFO] generating key: ecdsa-384
> 2018/05/01 19:51:02 [DEBUG] generate key from request: algo=ecdsa, size=384
> 2018/05/01 19:51:02 [INFO] encoded CSR
> *** WARNING ***
>
> Self-signed certificates are dangerous. Use this self-signed
> certificate at your own risk.
>
> It is strongly recommended that these certificates NOT be used
> in production.
>
> *** WARNING ***
The resulting certificate, though, has a 4 month expiration, none of the correct usages, and no CRL. If I, say, rename the default section of that config file and run the command, I'll get errors about no default section, so it's definitely seeing the config file. Why isn't it processing the parameters?
Contributor guide
Assessment
This issue has not been assessed yet.