AdminClientError when trying to add x509 allow

[techjockeynet]

I'm trying on a fresh install to add step ca policy via

step ca policy authority x509 allow dns "*local"
✔ Please enter admin name/subject (e.g., name@example.com): admin-user
✔ Provisioner: admin-user (JWK) [kid: ..-I9k7nLnEK-HknM]
Please enter the password to decrypt the provisioner key:
error retrieving policy: error retrieving policy: json: cannot unmarshal number into Go value of type ca.AdminClientError

Step-ca is running and was initialized with this command:
step ca init --name="MyCA" --dns="stepca01.test.local" --dns="localhost" --dns="192.168.1.50" --address="0.0.0.0:443" --provisioner="admin-user" --deployment-type standalone

Using documentation:
https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/allow/dns/#options

[hslatman]

Have you enabled remote management on your CA? You can find docs here: https://smallstep.com/docs/step-ca/provisioners/#remote-provisioner-management.

[hslatman]

Instead of an IP you could see if there's a way to use an .internal domain (or another FQDN using your own domain) name? It sounds like in your environment there's some level over (internal) DNS records.

[infotechguynet]

We currently use .local (e.g company.local)

[hslatman]

That's generally seen as a bad practice, as it's used by mDNS. There could be clashes in the names that are registered dynamically. But if your network isn't too big, and things work for you, then I suppose it can be used.

[infotechguynet]

Would this cause issues with IP addresses in the CSR being submitted to Step-CA? It is a allowed to sign for the company.local domain internally...

[hslatman]

No, using a .local shouldn't be an issue if you're using ACME and the CA is able to resolve the domain locally. IP addresses will only work if the CA can connect to them directly using http-01 or tls-alpn-01, though.