"step ca certificate" works with PKCS11 #1443
Description
Hello!
- Vote on this issue by adding a 👍 reaction
- If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)
Issue details
Now we want to generate the leaf certificate by the "step ca certificate", and hope it can use the private key in the TPM2.0 via PKCS11 which created by the "step-kms-plugin".
But we failed, when we used such a command "step ca certificate 10.72.1.101 /etc/nginx/conf.d/certs/nginx-0620.crt pkcs11:id=10000000 --token a-token --ca-url=https://192.168.51.101:6000 --root=/etc/nginx/conf.d/certs/root_ca.crt" , and expect to generate a certificate and no private file cause the private key exists in the KMS URI, but actually there genetate a private key which file name was "pkcs11:id=10000000", and the content of the file exactly is a private key, it seems the KMS parameter was not useful, and can't use the private key which existed in the TPM 2.0.
Why is this needed?
We want to use TPM 2.0 to protect our CA private key as the same as the leaf private key.