Remove support for creating new Linked CA deployments:
- Remove "linked" from --deployment-type flag options
- Return clear error when --deployment-type=linked is used
- Remove "Linked" from interactive deployment type selection
- Update help text to point users to Step CA Pro
Existing Linked CAs can still run (via certificates repo) but
new ones cannot be created in open-source step-ca.
This is phase 1 of removing Linked CA from open-source step-ca.
A future release will remove the functionality entirely.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit suppresses the message "certificate does not need renewal"
on the `step certificate needs-renewal` and `step ssh needs-renewal`
unless the `--verbose` flag is passed.
The ACME-DA flow in the step ca certificate command expects all KMS parameters
to be provided through the `--attestation-uri` flag. Using the `--kms` flag at the
same time can lead to errors. For example, if the YubiKey PIN is set with the
`--kms` flag, the flow will ignore it and use the default one instead, resulting
in a PIN retry error.
Fixes#1492
This commit adds the `--pkix` flag to `step crypto key fingerprint` command.
This flag and the PKIX encoding of the key instead of the X.509 subjectPublicKey
format.
This PR fixes the following issues:
- SCEP provisioners not detected in admin token flows
- Invalid provisioner selection logic when managing provisioner policies
- Unexpected error messages showing "issuer" instead or "provisioner" flag
- min-encryption-password-length
- provisioner
Enforce min-encryption-password-length, if set, in the 'step ssh
certificate' command.
Add flags.FirstStringOf returns value of first defined flag in input list
Add the `--set` and `--set-file` flags to the `step ca token` command,
allowing the user to set keys in the "user" claim in the resulting JWT.
Signed-off-by: Dan Fuhry <dan@fuhry.com>
This commit adds the `--console` flag to the following commands:
* `step ssh certificate`
* `step ssh config`
* `step ssh hosts`
* `step ssh login`
* `step ssh proxycommand`
This commit upgrades go.step.sm/crypto. The new version includes
template support for rawSubject. It also updates `step certificate sign`
to use the RawSubject instead of the constructed subject.
Add args and functionality to certificate verify to check a CRL
and OCSP for a certificate based on the extensions. Users can pass
flags to enable verification of each (CRL, OCSP). The command will try
and get the CRL and OCSP server from the certifiacate and verify the
certificate against each.
I also moved functions from the crl command into internal/crlutil
package so they can be re-used with the certificate verify command.
Implements #845
