-
Notifications
You must be signed in to change notification settings - Fork 317
feat: add --friendly-name flag to step certificate p12 - #1688
Draft
zorhehs wants to merge 1 commit into
Draft
Conversation
step certificate p12 hardcoded the trust-store friendly name to '<subject> - <fingerprint>', with no way to override it (unlike openssl pkcs12's -name option). Adds --friendly-name to override this default. Scoped to the trust-store case (--ca only, no cert/key) and to exactly one certificate: the underlying go-pkcs12 library's Encoder.Encode() (used for the cert+key identity-store case) doesn't expose a friendly-name parameter at all, and applying one name to multiple certificates isn't well-defined. Both cases now fail with a clear error instead of being silently ignored. Verified manually end-to-end (real step binary, real openssl-decoded .p12 output) and covered with unit tests exercising: friendly name applied correctly, default unaffected when the flag is omitted, and both rejection cases. Fixes smallstep#1004
@github-actions
github-actions
Bot
added
the
needs triage
Waiting for discussion / prioritization by team
label
Aug 23, 2026
CLA assistant check
All committers have signed the CLA.
zorhehs
marked this pull request as draft
August 28, 2026 09:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1004
What
Adds a
--friendly-nameflag tostep certificate p12, letting usersoverride the default
<subject> - <fingerprint>friendly name (alias)used in the .p12 trust store — matching
openssl pkcs12's-nameoption.
Scope
This is scoped to the trust-store case (
--caonly, no cert/key) andto exactly one certificate:
go-pkcs12library'sEncoder.Encode()(used for thecert+key "identity store" case) doesn't expose a friendly-name
parameter at all — it hardcodes
LocalKeyIdto the cert's SHA-1fingerprint.
--friendly-namecombined with a cert+key now failswith a clear error instead of being silently ignored.
well-defined, so that combination is also rejected with a clear error.
I raised this scoping decision on the issue before implementing, in
case identity-store support is worth pursuing separately via a
library-level change.
Testing
unaffected when the flag is omitted, both rejection cases
stepbinary and realcertificates, confirming the friendly name via
openssl pkcs12 -info