Subject order and missing DC attributes when signing intermediate CA with smallstep (Microsoft CA compatibility issue)

未关闭
  • 哪里不对？
#1,606 2 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
需要澄清
活跃度
冷清
技术栈
go
领域
cryptography, security

调研方向

Start by reproducing the issue with the shown step certificate sign command, the intermediate CA CSR, and the custom template using .Insecure.CR.Subject. Compare the subject order and extensions in the CSR and issued certificate, then inspect the certificate-signing and template handling paths. Done means determining whether CSR subject order can be preserved and documenting or correcting the behavior without breaking the existing subject override.

由索引模型根据 Issue 内容生成。

描述

enhancement needs triage

Hello!

  • Vote on this issue by adding a 👍 reaction
  • If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Hi everyone,

I’m currently trying to use a smallstep root CA to sign a Microsoft Windows CA as a subordinate CA, but I’m running into issues with the subject field handling.

Here’s my setup:

I created a CSR for the Microsoft CA.
Then I signed it using my smallstep root CA with:

step certificate sign \ --profile intermediate-ca \ intermediate-ms.csr \ /etc/step-ca/certs/root_ca.crt \ /etc/step-ca/secrets/root_ca_key

Initially, the resulting certificate was missing required extensions like:

CDP (CRL Distribution Point)
AIA (Authority Information Access)

So I created a custom template:

{ "subject": {{ toJson .Insecure.CR.Subject }}, "sans": {{ toJson .SANs }}, "issuingCertificateURL": "http://xxx/root.crt", {{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }} "keyUsage": ["keyEncipherment", "digitalSignature"], {{- else }} "keyUsage": ["digitalSignature"], {{- end }} "extKeyUsage": ["serverAuth", "clientAuth"], "basicConstraints": { "isCA": true, "maxPathLen": 0 }, "crlDistributionPoints": [ "http://xxx/root.crl" ] }

With this template, the extensions are now correct and accepted.

However, I’m facing a new issue with the subject:

In my CSR (.req), the subject looks like this:

CN=abc, DC=def, DC=ghi

When I use:

"subject": {{ toJson .Insecure.CR.Subject }}

the subject in the issued certificate becomes:

DC=ghi, DC=def, CN=abc

→ so all attributes are present, but the order is reversed.
If I instead use:

"subject": {{ toJson .Subject }}

then the resulting certificate only contains:

CN=abc

which makes sense because the template overrides the subject and only includes the CN.

Problem:
Microsoft CA seems to reject the certificate when the subject order is changed, even though the same attributes are present.

According to the documentation and discussions (e.g. issue #718), I expected .Insecure.CR.Subject to preserve the subject exactly as defined in the CSR — including the order — but that does not seem to be the case.

Questions:

Is the reordering of subject attributes when using .Insecure.CR.Subject expected behavior?
Is there any way to preserve the exact original subject order from the CSR?
Has anyone successfully used smallstep to sign a Microsoft subordinate CA certificate without running into this issue?

Any help would be greatly appreciated — I’m currently stuck on this.

Thanks!

Image

Why is this needed?

The .Insecure.CR.Subject Option in templates doesn't work like it should.

主要语言
Go
星标
4.3k
派生
320
平均合并
2 天 3 小时
30 天内合并 PR
11

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

smallstep/cli 的其他 Issue

查看 smallstep/cli 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。