From 3081f577f1831d52262b4c000cc389391206d4a3 Mon Sep 17 00:00:00 2001 From: Mustafa Senoglu Date: Thu, 6 Aug 2026 12:08:08 +0300 Subject: [PATCH] Remove KeyUsageCertSign requirement for X5C provisioner roots The CLI enforced that X5C root certificates must have the KeyUsageCertSign extension, but the step-ca API does not require this. A self-signed certificate without KeyUsageCertSign can successfully authenticate via --x5c-cert/--x5c-key flags, so the CLI should not reject it during provisioner creation. Closes #1329 --- command/ca/provisioner/add.go | 6 ------ command/ca/provisioner/update.go | 7 ------- 2 files changed, 13 deletions(-) diff --git a/command/ca/provisioner/add.go b/command/ca/provisioner/add.go index a6b081a7..4b5a7403 100644 --- a/command/ca/provisioner/add.go +++ b/command/ca/provisioner/add.go @@ -633,12 +633,6 @@ func createX5CDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) { } var rootBytes [][]byte for _, r := range roots { - if r.KeyUsage&x509.KeyUsageCertSign == 0 { - return nil, errors.Errorf("error: certificate with common name '%s' cannot be "+ - "used as an X5C root certificate.\n\n"+ - "X5C provisioner root certificates must have the 'Certificate Sign' key "+ - "usage extension.", r.Subject.CommonName) - } rootBytes = append(rootBytes, pem.EncodeToMemory(&pem.Block{ Type: "CERTIFICATE", Bytes: r.Raw, diff --git a/command/ca/provisioner/update.go b/command/ca/provisioner/update.go index 98f6cabe..8281ae65 100644 --- a/command/ca/provisioner/update.go +++ b/command/ca/provisioner/update.go @@ -4,7 +4,6 @@ import ( "crypto/ecdsa" "crypto/ed25519" "crypto/rsa" - "crypto/x509" "encoding/pem" "fmt" "net/url" @@ -702,12 +701,6 @@ func updateX5CDetails(ctx *cli.Context, p *linkedca.Provisioner) error { } var rootBytes [][]byte for _, r := range roots { - if r.KeyUsage&x509.KeyUsageCertSign == 0 { - return errors.Errorf("error: certificate with common name '%s' cannot be "+ - "used as an X5C root certificate.\n\n"+ - "X5C provisioner root certificates must have the 'Certificate Sign' key "+ - "usage extension.", r.Subject.CommonName) - } rootBytes = append(rootBytes, pem.EncodeToMemory(&pem.Block{ Type: "CERTIFICATE", Bytes: r.Raw,