From f5983cf1035082135f2b5d48a3f1a177680a6234 Mon Sep 17 00:00:00 2001 From: Lars Kellogg-Stedman Date: Sun, 11 Feb 2024 14:42:15 -0500 Subject: [PATCH] Teach step ca init about --key-password-file This commit permits you, when using the --root and --key options, to pass the password for decrypting the key in --key-password-file rather than requiring an interactive prompt. Example usage: step ca init --root root.crt --key root.key \ --key-password-file root_key_password ... Closes #453 --- command/ca/init.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/command/ca/init.go b/command/ca/init.go index 3a9b77c1f..e255e17fc 100644 --- a/command/ca/init.go +++ b/command/ca/init.go @@ -37,7 +37,7 @@ func initCommand() cli.Command { Action: cli.ActionFunc(initAction), Usage: "initialize the CA PKI", UsageText: `**step ca init** -[**--root**=] [**--key**=] [**--pki**] [**--ssh**] +[**--root**=] [**--key**=] [**--key-password-file**=] [**--pki**] [**--ssh**] [**--helm**] [**--deployment-type**=] [**--name**=] [**--dns**=] [**--address**=
] [**--provisioner**=] [**--admin-subject**=] [**--provisioner-password-file**=] @@ -57,6 +57,10 @@ func initCommand() cli.Command { Usage: "The path of an existing key of the root certificate authority.", EnvVar: step.IgnoreEnvVar, }, + cli.StringFlag{ + Name: "key-password-file", + Usage: `The path to the containing the password to decrypt the existing root certificate key.`, + }, cli.BoolFlag{ Name: "pki", Usage: "Generate only the PKI without the CA configuration.", @@ -240,10 +244,14 @@ func initAction(ctx *cli.Context) (err error) { case root == "" && key != "": return errs.RequiredWithFlag(ctx, "key", "root") case root != "" && key != "": + opts := []pemutil.Options{} + if keyPasswordFile := ctx.String("key-password-file"); keyPasswordFile != "" { + opts = append(opts, pemutil.WithPasswordFile(keyPasswordFile)) + } if rootCrt, err = pemutil.ReadCertificate(root); err != nil { return err } - if rootKey, err = pemutil.Read(key); err != nil { + if rootKey, err = pemutil.Read(key, opts...); err != nil { return err } case ra != "" && ra != apiv1.CloudCAS && ra != apiv1.StepCAS: