template change value

[conloos]

Hi @ALL,

based on this post I created a template:

{
  "subject": {
{{- if .Insecure.User.organizationalUnit }}
  "organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
{{- else }}
  "organizationalUnit": {{ toJson .organizationalUnit }},
{{- end }}
{{- if .Insecure.User.organization }}
  "organization": {{ toJson .Insecure.User.organization }},
{{- else }}
  "organization": {{ toJson .organization }},
{{- end }}
{{- if .Insecure.User.locality }}
  "locality": {{ toJson .Insecure.User.locality }},
{{- else }}
  "locality": {{ toJson .locality }},
{{- end }}
{{- if .Insecure.User.Province }}
  "province": {{ toJson .Insecure.User.province }},
{{- else }}
  "province": {{ toJson .province }},
{{- end }}
{{- if .Insecure.User.Country }}
  "country": {{ toJson .Insecure.User.country }},
{{- else }}
  "country": {{ toJson .country }},
{{- end }}
  "commonName": {{ toJson .Subject.CommonName }}
  },
  "sans": {{ toJson .SANs }},
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
    "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
    "keyUsage": ["digitalSignature"],
{{- end }}
  "keyUsage": ["digitalSignature"],
  "extKeyUsage": ["serverAuth", "clientAuth"]
}

The values are predefined in the ca.json:

"provisioners": [
      {
        "type": "ACME",
        "name": "acme",
          "options": {
            "x509": {
            "templateFile": "templates/certs/x509/leaf.tpl",
            "templateData": {
              "country": "DE",
              "organization": "test",
              "organizationalUnit": "lab",
              "province": "Berlin",
              "locality": "Berlin"
            }
          }
        }
      }
    ],

But I'm not able to change a value by certificate creation:

# step-cli ca certificate test.example.com leaf.csr leaf.crt --set "organizationalUnit=mylab"

or

# step-cli certificate create test.example.com leaf.csr leaf.key --csr
# step-cli ca sign --set "organizationalUnit=mylab" leaf.csr leaf.crt

try on both:

# step-cli certificate inspect leaf.crt

[...]
Subject: C=DE,ST=Berlin,L=Berlin,O=test,OU=lab,CN=test.example.com
[...]

I tryed:

• organizationalUnit=mylab
• ou=mylab
• OU=mylab

How i have to use --set "key=value" the right way?

Thanks Frank

[maraino]

I've tried your template and seems to work right for me:

$ step ca sign --force --set "organizationalUnit=mylab" leaf.csr leaf.crt && step certificate inspect leaf.crt | grep Subject\:
✔ Provisioner: mariano@smallstep.com (JWK) [kid: nvgnR8wSzpUlrt_tC3mvrhwhBx9Y7T1WL_JjcFVWYBQ]
Please enter the password to decrypt the provisioner key:
✔ CA: https://ca.smallstep.com:9000
✔ Certificate: leaf.crt
        Subject: C=US,ST=California,L=San Francisco,STREET=1 The Street St,O=Smallstep,OU=mylab,CN=test.example.com
$ step ca sign --force  leaf.csr leaf.crt && step certificate inspect leaf.crt | grep Subject\:
✔ Provisioner: mariano@smallstep.com (JWK) [kid: nvgnR8wSzpUlrt_tC3mvrhwhBx9Y7T1WL_JjcFVWYBQ]
Please enter the password to decrypt the provisioner key:
✔ CA: https://ca.smallstep.com:9000
✔ Certificate: leaf.crt
        Subject: C=US,ST=California,L=San Francisco,STREET=1 The Street St,O=Smallstep,OU=FooBarZar,CN=test.example.com

You can also configure a global subject adding the .authority.template like this:

{
  "root": "...",
  "...": "...",
  "authority": {
    "...": "..."
    "template": {
      "country": "US",
      "organization": "Smallstep",
      "organizationalUnit": "Smallstep Eng",
      "locality": "San Francisco",
      "province": "California",
      "streetAddress": "1 The Street St",
      "postalCode": "12345"
    }
  }
}

In my example, I had that and the "organizationalUnit": "FooBarZar" under the provisioner options.

[maraino]

And same for step ca certificate:

$ step ca certificate test.example.com leaf.crt leaf.key --force --set "organizationalUnit=mysecondlab" && step certificate inspect leaf.crt | grep Subject\:
✔ Provisioner: mariano@smallstep.com (JWK) [kid: nvgnR8wSzpUlrt_tC3mvrhwhBx9Y7T1WL_JjcFVWYBQ]
Please enter the password to decrypt the provisioner key:
✔ CA: https://ca.smallstep.com:9000
✔ Certificate: leaf.crt
✔ Private Key: leaf.key
        Subject: C=US,ST=California,L=San Francisco,STREET=1 The Street St,O=Smallstep,OU=mysecondlab,CN=test.example.com

[conloos]

Hi @maraino,

thank you, but both examples didn't work.
I'm on Version 0.18.1 and deployed by the ansible-roles of maxhoesel.

# step-cli ca sign --force --set "organizationalUnit=mylab" leaf.csr leaf.crt && step-cli certificate inspect leaf.crt | grep Subject\:
✔ Provisioner: acme (ACME)
Using Standalone Mode HTTP challenge to validate test.example.com . done!
Waiting for Order to be 'ready' for finalization .. done!
Finalizing Order .. done!
✔ Certificate: leaf.crt
        Subject: C=DE,ST=Berlin,L=Berlin,O=test,OU=lab,CN=test.example.com

But i'm the user root. In your example you may be an other user because "$"?

I configured the second example, but i think i miss configured something:

# vi /etc/step-ca/config/ca.json
{
  "root": "...",
  "...": "...",
  "authority": {
    "provisioners": [
      {
        "type": "ACME",
        "name": "acme",
        "template": {
          "country": "DE",
          "organization": "test",
          "organizationalUnit": "lab",
          "locality": "Berlin",
          "province": "Berlin",
          "StreetAddress": "1 The Street St",
          "postalCode": "12345"
          }
      }
    ]
  },
  "template": {},

# step-cli ca sign --force --set "organizationalUnit=mylab" leaf.csr leaf.crt && step-cli certificate inspect leaf.crt | grep Subject\:
✔ Provisioner: acme (ACME)
Using Standalone Mode HTTP challenge to validate test.bodomos.lan . done!
Waiting for Order to be 'ready' for finalization .. done!
Finalizing Order .. done!
✔ Certificate: leaf.crt
        Subject: CN=test.example.com

[maraino]

I know what's going on, you're using the ACME protocol, and this protocol does not have a way to pass custom template properties using --set or --set-file. You can use any other provisioner, but not the ACME one.

And by the way, the template I was referring to goes one level up, inside the authority not in a provisioner.

[maraino]

In my tests from above, I was using a JWK provisioner.

[DonOtuseGH]

I'd expect a warning message at least when some options can't be used/processed by certain provisioners. It could maybe become an additional enhancement request, right?