[Bug]: Certificate renewal does not preserve Subject with ExtraNames

Steps to Reproduce

Create a new provisioner with a template that has ExtraNames in the Subject, eg:

{
  "subject": {
              "extraNames": [
                   { "type": "0.9.2342.19200300.100.1.25", "value":"com" },
                   { "type": "0.9.2342.19200300.100.1.25", "value":"example" },
                   { "type": "0.9.2342.19200300.100.1.25", "value":"dc" },
                   { "type": "2.5.4.11", "value":"Domain Controllers" },
                   { "type": "2.5.4.3", "value": {{ toJson .Subject.CommonName }} }
              ]
  },
  "sans": {{ toJson .SANs }},
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
  "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
  "keyUsage": ["keyAgreement", "digitalSignature"],
{{- end }}
  "extKeyUsage": ["serverAuth", "clientAuth"]
}

Obtain a certificate normally (eg step ca certificate TestCert testcert.crt testcert.key)
The new certificate will have a correct Subject eg: Subject: DC=com,DC=example,DC=dc,OU=Domain Controllers,CN=TestCert
Renew certificate with step (eg step ca renew --force testcert.crt testcert.key)
The resulting certificate will be missing any ExtraNames golang does not support (in this example the renewed certificate has Subject: OU=Domain Controllers,CN=TestCert

Additionally Subject order is not preserved, so in some cases you may get Subject: CN=TestCert,OU-Domain Controllers

Your Environment

OS - Linux
step-ca Version - Smallstep CA/0.23.0-rc.1 (linux/amd64)

Expected Behavior

Subject should be preserved

Actual Behavior

Subject is re-written with missing ExtraNames

Additional Context

I had a quick look through the code and couldnt see a quick fix for this one, it seems step-ca parses the certificates using x509 pretty early on and then copies the Subject across, which is missing the ExtraNames

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

smallstep / certificates