`step ca certificate` should warn when passed-in subject names are ignored

tashian commented 2 months ago

When I get a certificate using an OIDC provisioner, the --san I provide is silently ignored. step should warn the user that the flag was ignored.

example output:

step ca certificate vpn --san strongswan.lan vpn.crt vpn.key --not-after 8784h
✔ Provisioner: authority-admin (OIDC) [client: de7774d8-a136-4e29-8450-026022a64ce4]
Your default web browser has been opened to visit:

https://auth.smallstep.com/oidc/auth?client_id=de77...

⚠️ Your subject name and --san flag were ignored. By default, OIDC provisioners issue certificates based on trusted OIDC token values only.
✔ CA: https://my.ca.smallstep.com
✔ Certificate: vpn.crt
✔ Private Key: vpn.key

hslatman commented 1 month ago

Check if SANs are ignored in the request to the CA. If it is, it can be short-circuited in the CLI.

maraino commented 1 month ago

A CSR with the given SANs is created. A certificate template can be used to set the SANs from the CSR instead of the default ones for an OIDC provisioner, the email and the account URI. Example of the CSR request:

smallstep / cli

`step ca certificate` should warn when passed-in subject names are ignored #1271