Use template for CA API (and configurable subject encoding) #2653

Activity

1. Gabgobie

   added

   enhancement

   needs triageWaiting for discussion / prioritization by teamWaiting for discussion / prioritization by team

   on Apr 17, 2026
2. Gabgobie commented on Apr 17, 2026

   

   Gabgobie

   on Apr 17, 2026

   Last edited by Gabgobie

   Author

   More actions

   Maybe this can be achieved per field using asn1enc but I think this would still not solve the re-encoding of the CN field.

   asn1Enc "utf8:foobar"

   Edit:

   Possibly by wrapping it in the marshall thing?

   (asn1Marshal (.Insecure.CR.Subject.CommonName) "utf8") or similar?
3. Gabgobie commented on Apr 17, 2026

   

   Gabgobie

   on Apr 17, 2026

   Last edited by Gabgobie

   Author

   More actions

   Edit: I didn't get it quite right, see the below comment.

   ---

   certificates/authority/config/config.go

   Lines 143 to 172 in 14f4ad7

   	// ASN1DN contains ASN1.DN attributes that are used in Subject and Issuer
   	// x509 Certificate blocks.
   	type ASN1DN struct {
   	Country string `json:"country,omitempty"`
   	Organization string `json:"organization,omitempty"`
   	OrganizationalUnit string `json:"organizationalUnit,omitempty"`
   	Locality string `json:"locality,omitempty"`
   	Province string `json:"province,omitempty"`
   	StreetAddress string `json:"streetAddress,omitempty"`
   	SerialNumber string `json:"serialNumber,omitempty"`
   	CommonName string `json:"commonName,omitempty"`
   	}
   	// AuthConfig represents the configuration options for the authority. An
   	// underlaying registration authority can also be configured using the
   	// cas.Options.
   	type AuthConfig struct {
   	*cas.Options
   	AuthorityID string `json:"authorityId,omitempty"`
   	DeploymentType string `json:"deploymentType,omitempty"`
   	Provisioners provisioner.List `json:"provisioners,omitempty"`
   	Admins []*linkedca.Admin `json:"-"`
   	Template *ASN1DN `json:"template,omitempty"`
   	Claims *provisioner.Claims `json:"claims,omitempty"`
   	Policy *policy.Options `json:"policy,omitempty"`
   	DisableIssuedAtCheck bool `json:"disableIssuedAtCheck,omitempty"`
   	Backdate *provisioner.Duration `json:"backdate,omitempty"`
   	EnableAdmin bool `json:"enableAdmin,omitempty"`
   	DisableGetSSHHosts bool `json:"disableGetSSHHosts,omitempty"`
   	}

   So if I got this right the "authority" level "template" is different from the provisioner level "template". At least that gives me a bit of an explanation why I haven't seen my template used at all. Step-CA is unable to issue a valid cert for itself and acme clients refuse to connect due to the invalid cert. Therefore I only tried connecting directly to step to check my certs.

   Now I still didn't get it to issue any DN values of my choice but if I am correct, the effort is futile anyways because the server certificate step issues for itself is also required to contain an explicit policy, which, given the different template struct, is impossible.
4. Gabgobie commented on Apr 18, 2026

   

   Gabgobie

   on Apr 18, 2026

   Author

   More actions

   At the risk of derailing the issue, I was digging around and this function should be the one issuing the API certificate.

   certificates/authority/tls.go

   Lines 884 to 984 in 14f4ad7

   	// GetTLSCertificate creates a new leaf certificate to be used by the CA HTTPS server.
   	func (a *Authority) GetTLSCertificate() (*tls.Certificate, error) {
   	fatal := func(err error) (*tls.Certificate, error) {
   	return nil, errs.Wrap(http.StatusInternalServerError, err, "authority.GetTLSCertificate")
   	}
   	// Generate default key.
   	priv, err := keyutil.GenerateDefaultKey()
   	if err != nil {
   	return fatal(err)
   	}
   	signer, ok := priv.(crypto.Signer)
   	if !ok {
   	return fatal(errors.New("private key is not a crypto.Signer"))
   	}
   	// prepare the sans: IPv6 DNS hostname representations are converted to their IP representation
   	sans := make([]string, len(a.config.DNSNames))
   	for i, san := range a.config.DNSNames {
   	if strings.HasPrefix(san, "[") && strings.HasSuffix(san, "]") {
   	if ip := net.ParseIP(san[1 : len(san)-1]); ip != nil {
   	san = ip.String()
   	}
   	}
   	sans[i] = san
   	}
   	// Create initial certificate request.
   	cr, err := x509util.CreateCertificateRequest(a.config.CommonName, sans, signer)
   	if err != nil {
   	return fatal(err)
   	}
   	// Generate certificate template directly from the certificate request.
   	template, err := x509util.NewCertificate(cr)
   	if err != nil {
   	return fatal(err)
   	}
   	// Get x509 certificate template, set validity and sign it.
   	now := time.Now()
   	certTpl := template.GetCertificate()
   	certTpl.NotBefore = now.Add(-1 * time.Minute)
   	certTpl.NotAfter = now.Add(24 * time.Hour)
   	// Policy and constraints require this fields to be set. At this moment they
   	// are only present in the extra extension.
   	certTpl.DNSNames = cr.DNSNames
   	certTpl.IPAddresses = cr.IPAddresses
   	certTpl.EmailAddresses = cr.EmailAddresses
   	certTpl.URIs = cr.URIs
   	// Fail if name constraints do not allow the server names.
   	if err := a.constraintsEngine.ValidateCertificate(certTpl); err != nil {
   	return fatal(err)
   	}
   	// Set the cert lifetime as follows:
   	// i) If the CA is not a StepCAS RA use 24h, else
   	// ii) if the CA is a StepCAS RA, leave the lifetime empty and
   	// let the provisioner of the CA decide the lifetime of the RA cert.
   	var lifetime time.Duration
   	if casapi.TypeOf(a.x509CAService) != casapi.StepCAS {
   	lifetime = 24 * time.Hour
   	}
   	resp, err := a.x509CAService.CreateCertificate(&casapi.CreateCertificateRequest{
   	Template: certTpl,
   	CSR: cr,
   	Lifetime: lifetime,
   	Backdate: 1 * time.Minute,
   	IsCAServerCert: true,
   	})
   	if err != nil {
   	return fatal(err)
   	}
   	// Generate PEM blocks to create tls.Certificate
   	pemBlocks := pem.EncodeToMemory(&pem.Block{
   	Type: "CERTIFICATE",
   	Bytes: resp.Certificate.Raw,
   	})
   	for _, crt := range resp.CertificateChain {
   	pemBlocks = append(pemBlocks, pem.EncodeToMemory(&pem.Block{
   	Type: "CERTIFICATE",
   	Bytes: crt.Raw,
   	})...)
   	}
   	keyPEM, err := pemutil.Serialize(priv)
   	if err != nil {
   	return fatal(err)
   	}
   	tlsCrt, err := tls.X509KeyPair(pemBlocks, pem.EncodeToMemory(keyPEM))
   	if err != nil {
   	return fatal(err)
   	}
   	// Set leaf certificate
   	tlsCrt.Leaf = resp.Certificate
   	return &tlsCrt, nil
   	}

   If I got this right, the CSR is only using Config.CommonName and entirely ignores Config.AuthorityConfig.Template
5. Gabgobie

   changed the title [-]Configurable subject encoding[/-] [+]Configurable subject (and encoding)[/+] on Apr 18, 2026
6. Gabgobie

   changed the title [-]Configurable subject (and encoding)[/-] [+]Use template for CA API (and configurable subject encoding)[/+] on Apr 18, 2026
7. Gabgobie commented on Apr 23, 2026

   

   Gabgobie

   on Apr 23, 2026

   Author

   More actions

   After opening the issue for the initial suspect of subject encoding I discovered that the issue is a bit deeper as is apparent from my other comments. If it is of any value, I can try to reword the opening comment. ^^