Brutkey

Jan Wildeboer 😷😷:krulorange:
@jwildeboer@social.wildeboer.net

OK. I'm giving up. It seems to be impossible to convince step-ca to include givenName and surname in the subject of an x509 certificate. I tried templates, --set in all variants but it seems it always ignores them. Maybe it'll work when I try the hardcore way with OIDs, but that'll have to wait.

step-ca template file { "subject": { "Organization": {{ toJson .Organization }}, "organizationalUnit": {{ toJson .OrganizationalUnit }}, "country": "DE", "givenName": {{ toJson .Insecure.User.givenName }}, "surname": {{ toJson .Insecure.User.surname }}, "commonName": {{ toJson .Subject.CommonName }} }, "basicConstraints": { "isCA": false }, "extensions": [ {"id": "2.5.29.32", "value": {{ asn1Seq (asn1Seq (asn1Enc "oid:2.23.140.1.5.2.2")) | toJson }}} ], "sans": {{ toJson .SANs }}, "extKeyUsage": ["emailProtection", "clientAuth"], "keyUsage": ["keyEncipherment", "digitalSignature", "contentCommitment"] } Creating teh certificate with step ca certificate "nsmith@wildeboer.net" nsmith.crt nsmith.key --san "nsmith@wildeboer.net" --san "natsmith@wildeboer.net" --san "therealnat@wildeboer.net" --set=givenName=Nathaniel --set=surname=Smith --provisioner smime Checking the generated certificate: No surname, no GivenName in the subject. Subject: C=DE,O=JHW,OU=S/MIME,CN=nsmith@wildeboer.net
Jan Wildeboer 😷😷:krulorange:
@jwildeboer@social.wildeboer.net

I am asking for help now at https://github.com/smallstep/certificates/discussions/2358

Jan Wildeboer 😷😷:krulorange:
@jwildeboer@social.wildeboer.net

Yay! Thanks to some explanations from Herman Slatman I understood how step-ca evaluates my S/MIME certificate request and what I need to change to make it all work the way I want. Which it now does :)

https://github.com/smallstep/certificates/discussions/2358

Jan Wildeboer 😷😷:krulorange:
@jwildeboer@social.wildeboer.net

I have updated my blog post at https://jan.wildeboer.net/2025/08/Create-SMIME-Cert-stepca/ accordingly. cc @ben@bluetoot.hardill.me.uk FYI