Certificate generation: SAN not present with latest step CLI
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 60
- Forks
- 221
- Avg merge
- 4h 32m
- Merged PRs (30d)
- 1
Description
Go 1.15 expects certificates to have a SAN (see https://github.com/golang/go/issues/39568). This means also the latest Kubernetes requires certificates to have a SAN.
PR #809 added the `--san` option to all `step` command in this documentation.
With the latesy step CLI (currently version 0.15.3), this option is ignored for intermediate and root certificates. See also https://github.com/smallstep/cli/issues/386.
One possible solution is to use a custom certificate template with `step`, which includes SANs. This would mean commands would change like this:
```diff
- step certificate create identity.linkerd.cluster.local ca.crt ca.key \
- --profile root-ca --no-password --insecure --san identity.linkerd.cluster.local
+ cat >root.tpl <
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the certificate-generation commands introduced by PR #809 and compare the documented `step certificate create` invocations with step CLI 0.15.3 behavior described here. Confirm how SANs are handled for intermediate and root certificates, then update the documentation once a clear command approach is chosen and verify the examples work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100