Ability to have multiple Intermediate Certs

[willanta]

It would be handy to have an easy way of generating intermediate certificates after the ca init step and then choose which one to sign with when generating certs (maybe by provisioner).

Not everything can do online renewal and obey the standards enforced so having a shorter lived intermediate for signing this legacy stuff would be super useful. A lot of devices also don't support the proper cert chain so I'm having to distribute the intermediate cert with the root cert to clients and I'd rather keep that separate from the intermediate doing online provisioning.

[mmalone]

Related: smallstep/cli#213

[dopey]

Duplicate / Related to #87.

[wagnerflo]

Yes. Being able to select the intermediate (or rather chain of intermediates to be able to ship it with the issued leaf if I understood #440 correctly) a provisioner uses would be nice.

[voanhduy1512]

Unfortunately I can't find any doc on how to use #440 functionality.

[AluisioASG]

As far as I can tell, #440 is only about having multiple intermediates in a single chain, not about having multiple/per-provisioner chains (which is this issue).

[dopey]

@voanhduy1512 @AluisioASG is correct. #440 allows step-ca to use a certificate chain that is longer than just root -> intermediate -> leaf. It does not give you the ability to set different signing CA's per provisioner.

[TheSecMaven]

So just to confirm I understand this right, the ability to sign certs with one subordinate CA for a provisioner, and a different subordinate CA for another provisioner, is not currently possible?

Any thoughts as to how that would be enabled, if someone was able to work on it?

[mmalone]

Hey Miclain,

Correct. That's not currently possible. Hypothetically, I could see the intermediate signing key / certificate configured on a per-provisioner basis. Practically, there are a bunch of little complications & details that need to be sorted out to get that to work. It needs to be done in a way that doesn't complicate the user experience for more typical use cases. I think we'd need a thorough design document that we could stare at before we can even size this one. At the moment, it's not on the top of the priority list.

Internally, we have a piece of technology that runs many instances of step-ca in a single process. We use this in our commercial product. That serves a similar purpose, except that each subordinate ends up with a different domain name. Instances of step-ca are pretty lightweight. Would running multiple instances (e.g., in containers, or on the same VM behind an SNI-routing TCP proxy) work here?

I encourage anyone in the community who wants this feature implemented to express interest here by giving the issue a thumbs up or, even better, responding with a brief description of their use case / requirements to help us prioritize.