Define the default kty in ca.json

[MacWeber]

I've tried to define the default key type generated by the ACME server the same way as the JWK provisioner is configured in ca.json.
However, the configuration is not picked by the provisioner, as I can verify running:

$ step ca provisioner list         
[
   {
      "type": "ACME",
      "name": "acme",
      "claims": {
         "enableSSHCA": true,
         "disableRenewal": false,
         "allowRenewalAfterExpiry": false
      },
      "options": {
         "x509": {},
         "ssh": {}
      }
   }
]

I also tried to add a global setting to set "kty": "OKP" and "crv": "Ed25519", and I've tried the same thing under options -> x509. None worked.

How to define the default key type in ca.json? Is this option currently available only for some kind of provisioners? Is there any other method to set this option on the server side?

[maraino]

What exactly do you mean by "the default key type generated by the ACME server"?

Currently, the certificate for the step-ca server (HTTPS) cannot be changed, and it always uses an ECDSA P-256 key. But it can SIGN a certificate with an RSA, Ed25519, or an ECDSA key. And you can also use an ACME account with those keys.

In the client side, if you're using step you can use the flag --kty OKP to get a certificate with Ed25519 key:

step ca certificate --kty OKP --provisioner  acme localhost localhost.crt localhost.key

Other ACME clients might have other options to support different keys or accounts.

It is also possible to change the root and/or intermediates with an Ed25519 key, but currently, you need to create those with step certificate create and replace the certificate and key in the ca.json. The server certificate will still be an ECDSA P-256 key.

[MacWeber]

Thanks, @maraino! I was expecting the server cert to be as the same kind as the intermediate cert, and I was also expecting those configurations in ca.json to define the default certificate types issued by the server.

Currently, the certificate for the step-ca server (HTTPS) cannot be changed, and it always uses an ECDSA P-256 key.

I've opened this issue to allow changing the step-ca server's certificate type.
Out of curiosity, where is this certificate stored?

But it can SIGN a certificate with an RSA, Ed25519, or an ECDSA key. And you can also use an ACME account with those keys.
In the client side, if you're using step you can use the flag --kty OKP to get a certificate with Ed25519 key: [...]

Is it possible to restrict the certificate types issued by the CA? Can the default issued certificate type be configured on the server side instead of configuring it in every single client?

[maraino]

About the issue, it makes sense. I thought about doing that before, but there was not much push from the community to do it. I will advocate for this in our internal triage.

Out of curiosity, where is this certificate stored?

In memory only

Is it possible to restrict the certificate types issued by the CA? Can the default issued certificate type be configured on the server side instead of configuring it in every single client?

Yes and no. It is possible to use templates to detect the key type and fail if it is not the desired one. In the default template, we detect RSA keys to add different key usages. See here. You can for example {{ fail "message" }} if it is not the desired one. But we cannot configure the client from the server side. If you're using authority contexts on the client side, you can, for example, distribute profiles that add the desired options. Profiles are similar to the $(step path)/config/defaults.json, but don't have commands to overwrite them. For example, if you do step ca bootstrap ... again we might overwrite your defaults.json after asking for permission. But we do not overwrite profiles.