unable to set a IP-san

[conloos]

Hello @ALL,

I'm on version: CLI/0.18.1 and can't set a SAN with type IP. I've tried all possible combinations.

# step-cli certificate create test.example.com leaf.csr leaf.key --san 192.168.178.36 --csr
Please enter the password to encrypt the private key: 
Your certificate signing request has been saved in leaf.csr.
Your private key has been saved in leaf.key.

# step-cli ca sign leaf.csr leaf.crt
✔ Provisioner: acme (ACME)
Using Standalone Mode HTTP challenge to validate test.example.com . done!
Waiting for Order to be 'ready' for finalization .. done!
Finalizing Order .error finalizing order: The CSR is unacceptable

My Template is this from the tutorial:

{
    "subject": {{ toJson .Subject }},
    "sans": {{ toJson .SANs }},
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
    "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
    "keyUsage": ["digitalSignature"],
{{- end }}
    "extKeyUsage": ["serverAuth", "clientAuth"]
}

my provisioners:

{
  "type": "ACME",
  "name": "acme",
    "options": {
      "x509": {
        "templateFile": "templates/certs/x509/leaf.tpl",
    }
  }
}

Greeting Frank

[hslatman]

Hi @conloos,

It seems I've missed your particular flow (saving a CSR in between steps) when adding support for IP SANs in the CLI when using ACME. A working flow would involve only a single call to the CA:

$ step ca certificate test.localhost test.crt test.key --provisioner <your-acme-provisioner> --san 127.0.0.1
Using Standalone Mode HTTP challenge to validate 127.0.0.1 . done!
Using Standalone Mode HTTP challenge to validate t.localhost . done!
Waiting for Order to be 'ready' for finalization .. done!
Finalizing Order .. done!

Does this work for you?

I'll have a look at supporting it in the CSR flow, too.

[conloos]

The way described works.

[hslatman]

@conloos: I've opened a PR to make this also work with a CSR: smallstep/cli#630. If you have a preference for using that method, you'll be able to do so in the next CLI release 😄