Subject order and missing DC attributes when signing intermediate CA with smallstep (Microsoft CA compatibility issue)

Abierto
  • ¿Algo no está bien?
#1,606 2 comentarios 1 reacción 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Tranquilo
Stack tecnológico
go
Área
cryptography, security

Línea de trabajo

Start by reproducing the issue with the shown step certificate sign command, the intermediate CA CSR, and the custom template using .Insecure.CR.Subject. Compare the subject order and extensions in the CSR and issued certificate, then inspect the certificate-signing and template handling paths. Done means determining whether CSR subject order can be preserved and documenting or correcting the behavior without breaking the existing subject override.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement needs triage

Hello!

  • Vote on this issue by adding a 👍 reaction
  • If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Hi everyone,

I’m currently trying to use a smallstep root CA to sign a Microsoft Windows CA as a subordinate CA, but I’m running into issues with the subject field handling.

Here’s my setup:

I created a CSR for the Microsoft CA.
Then I signed it using my smallstep root CA with:

step certificate sign \ --profile intermediate-ca \ intermediate-ms.csr \ /etc/step-ca/certs/root_ca.crt \ /etc/step-ca/secrets/root_ca_key

Initially, the resulting certificate was missing required extensions like:

CDP (CRL Distribution Point)
AIA (Authority Information Access)

So I created a custom template:

{ "subject": {{ toJson .Insecure.CR.Subject }}, "sans": {{ toJson .SANs }}, "issuingCertificateURL": "http://xxx/root.crt", {{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }} "keyUsage": ["keyEncipherment", "digitalSignature"], {{- else }} "keyUsage": ["digitalSignature"], {{- end }} "extKeyUsage": ["serverAuth", "clientAuth"], "basicConstraints": { "isCA": true, "maxPathLen": 0 }, "crlDistributionPoints": [ "http://xxx/root.crl" ] }

With this template, the extensions are now correct and accepted.

However, I’m facing a new issue with the subject:

In my CSR (.req), the subject looks like this:

CN=abc, DC=def, DC=ghi

When I use:

"subject": {{ toJson .Insecure.CR.Subject }}

the subject in the issued certificate becomes:

DC=ghi, DC=def, CN=abc

→ so all attributes are present, but the order is reversed.
If I instead use:

"subject": {{ toJson .Subject }}

then the resulting certificate only contains:

CN=abc

which makes sense because the template overrides the subject and only includes the CN.

Problem:
Microsoft CA seems to reject the certificate when the subject order is changed, even though the same attributes are present.

According to the documentation and discussions (e.g. issue #718), I expected .Insecure.CR.Subject to preserve the subject exactly as defined in the CSR — including the order — but that does not seem to be the case.

Questions:

Is the reordering of subject attributes when using .Insecure.CR.Subject expected behavior?
Is there any way to preserve the exact original subject order from the CSR?
Has anyone successfully used smallstep to sign a Microsoft subordinate CA certificate without running into this issue?

Any help would be greatly appreciated — I’m currently stuck on this.

Thanks!

Image

Why is this needed?

The .Insecure.CR.Subject Option in templates doesn't work like it should.

Lenguaje dominante
Go
Estrellas
4.3k
Forks
320
Merge medio
2 d 3 h
PR fusionados (30 d)
11

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de smallstep/cli

Todos los issues de smallstep/cli

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.