This commit adds the `--pkix` flag to `step crypto key fingerprint` command.
This flag and the PKIX encoding of the key instead of the X.509 subjectPublicKey
format.
This PR fixes the following issues:
- SCEP provisioners not detected in admin token flows
- Invalid provisioner selection logic when managing provisioner policies
- Unexpected error messages showing "issuer" instead or "provisioner" flag
- min-encryption-password-length
- provisioner
Enforce min-encryption-password-length, if set, in the 'step ssh
certificate' command.
Add flags.FirstStringOf returns value of first defined flag in input list
Add the `--set` and `--set-file` flags to the `step ca token` command,
allowing the user to set keys in the "user" claim in the resulting JWT.
Signed-off-by: Dan Fuhry <dan@fuhry.com>
This commit adds the `--console` flag to the following commands:
* `step ssh certificate`
* `step ssh config`
* `step ssh hosts`
* `step ssh login`
* `step ssh proxycommand`
This commit upgrades go.step.sm/crypto. The new version includes
template support for rawSubject. It also updates `step certificate sign`
to use the RawSubject instead of the constructed subject.
Add args and functionality to certificate verify to check a CRL
and OCSP for a certificate based on the extensions. Users can pass
flags to enable verification of each (CRL, OCSP). The command will try
and get the CRL and OCSP server from the certifiacate and verify the
certificate against each.
I also moved functions from the crl command into internal/crlutil
package so they can be re-used with the certificate verify command.
Implements #845
* Allow users to define certificate comment in agent
Added a comment flag which allows users to set the comment for a
certificate when it gets added to an agent. It defaults to current
behavior if not set, which is it uses the subject as the comment.
This allows users who interact with mutliple CAs with the same
identity (email) to have multiple certificates in the agent. It
also allows for use cases when users generate SSH certs with different
extensions to load multiple certificates in their agent.
