Thread | Brutkey

:krulorange:
@jwildeboer@social.wildeboer.net

OK. I'm giving up. It seems to be impossible to convince step-ca to include givenName and surname in the subject of an x509 certificate. I tried templates, --set in all variants but it seems it always ignores them. Maybe it'll work when I try the hardcore way with OIDs, but that'll have to wait.

step-ca template file

{
"subject": {
"Organization": {{ toJson .Organization }},
"organizationalUnit": {{ toJson .OrganizationalUnit }},
"country": "DE",
"givenName": {{ toJson .Insecure.User.givenName }},
"surname": {{ toJson .Insecure.User.surname }},
"commonName": {{ toJson .Subject.CommonName }}
},
"basicConstraints": {
"isCA": false
},
"extensions": [
{"id": "2.5.29.32", "value": {{ asn1Seq (asn1Seq (asn1Enc "oid:2.23.140.1.5.2.2")) | toJson }}}
],
"sans": {{ toJson .SANs }},
"extKeyUsage": ["emailProtection", "clientAuth"],
"keyUsage": ["keyEncipherment", "digitalSignature", "contentCommitment"]
}

Creating teh certificate with

step ca certificate "nsmith@wildeboer.net" nsmith.crt nsmith.key --san "nsmith@wildeboer.net" --san "natsmith@wildeboer.net" --san "therealnat@wildeboer.net" --set=givenName=Nathaniel --set=surname=Smith --provisioner smime

Checking the generated certificate: No surname, no GivenName in the subject.

Subject: C=DE,O=JHW,OU=S/MIME,CN=nsmith@wildeboer.net

Jan Wildeboer 😷

:krulorange:
@jwildeboer@social.wildeboer.net

I am asking for help now at https://github.com/smallstep/certificates/discussions/2358

Jan Wildeboer 😷

:krulorange:
@jwildeboer@social.wildeboer.net

Yay! Thanks to some explanations from Herman Slatman I understood how step-ca evaluates my S/MIME certificate request and what I need to change to make it all work the way I want. Which it now does :)

https://github.com/smallstep/certificates/discussions/2358

Jan Wildeboer 😷

:krulorange:
@jwildeboer@social.wildeboer.net

I have updated my blog post at https://jan.wildeboer.net/2025/08/Create-SMIME-Cert-stepca/ accordingly. cc @ben@bluetoot.hardill.me.uk FYI