Repository navigation
Sign certificates without the step provisioner extension #620
Description
Discussed in #615
Originally posted by Kieren June 22, 2021
In order to use leaf certificates issued by step ca for mTLS in a particular IoT application the certificates cannot have extraneous extensions like X509v3 Step Provisioner. Is there a way to configure step ca to not issue leaf certificates with this extension?
For example the Arduino MKR Wifi 1010 board has an ATECC508A cryptographic authentication chip which has hardware based certificate storage for client certificates. However due to the storage limitations of the chip the certificates are deconstructed into a compressed form for storage, where known values like subject fields are stripped and stored separately. Certificates issued via step ca with the Step Provisioner extension cannot be used as a drop-in in this application.
Activity
maraino commentedon Jun 28, 2021
One thing to take into account is if we want to enable mTLS renewals of these certificates.
tashian commentedon Jun 28, 2021
Refs:
frank-park commentedon Jul 12, 2023
There are certain X509 ecosystem (ie the one we are working with) that prohibits adding any other extension outside what is specified in the policy. Unfortunately this extension has to be removed in order to comply with the policy.
Without mentioning the specific policy, this is part of a governmental regulatory policy.
Add disable_smallstep_extensions claim
Add support for the disableSmallstepExtensions claim
Add support for the disableSmallstepExtensions claim
Allow to disable smallstep extensions using the cli