"step ca certificate" works with PKCS11

未关闭
  • 哪里不对？
#1,443 3 条评论 1 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@hslatman 已经在做这个了。

开始于 2025年7月1日。

评估

这个 Issue 还没有评估数据。

描述

enhancement needs triage

Hello!

  • Vote on this issue by adding a 👍 reaction
  • If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Now we want to generate the leaf certificate by the "step ca certificate", and hope it can use the private key in the TPM2.0 via PKCS11 which created by the "step-kms-plugin".
But we failed, when we used such a command "step ca certificate 10.72.1.101 /etc/nginx/conf.d/certs/nginx-0620.crt pkcs11:id=10000000 --token a-token --ca-url=https://192.168.51.101:6000 --root=/etc/nginx/conf.d/certs/root_ca.crt" , and expect to generate a certificate and no private file cause the private key exists in the KMS URI, but actually there genetate a private key which file name was "pkcs11:id=10000000", and the content of the file exactly is a private key, it seems the KMS parameter was not useful, and can't use the private key which existed in the TPM 2.0.

Why is this needed?

We want to use TPM 2.0 to protect our CA private key as the same as the leaf private key.

主要语言
Go
星标
4.3k
派生
320
平均合并
2 天 3 小时
30 天内合并 PR
11

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

smallstep/cli 的其他 Issue

查看 smallstep/cli 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。