Using Step CA to Revoke Acme certs : failed to verify certificate: x509

[SebastienTolron]

Hi ,

First of all , thanks for the great job !

My Setup :

Step CA installed with Helm chart on Kubernetes.
Db : postgres
Version : 0.29.0

I have Setup an Acme Server with this url : https://acme-server.mydomain.local/

The cert is a cert generated with the intermediate CA.

I used cert manager to generate a cert for an url "https://myurl.mydomain.local"

Ok.

Now , I want to revoke that certificate. So I'm using the CLI.

Inside the container running my CA :

step ca revoke --reason "Cert compromised" --reasonCode "key compromise" 188119706389441743186708622321

Here is the result :

client GET https://acme-server.mydomain.local/provisioners?limit=100 failed: tls: failed to verify certificate: x509: certificate signed by unknown authority

The container does not trust the CA configured in it.

What I did , is mount a custom file in /etc/ssl/cert.pem with that intermediate trusted.

I can curl the url , but still step CA does not trust the ca :/

step-certificates-helm-0:~$ curl https://acme-server.mydomain.local/provisioners?limit
{"provisioners":[{"type":"acme","name":"myprovisionner","options":{"x509":{},"ssh":{}}}],"nextCursor":""}
step-certificates-helm-0:~$ step ca revoke --reason "Cert compromised" --reasonCode "key compromise" 188119706389441743186708622321
client GET https://acme-server.mydomain.local/provisioners?limit=100 failed: tls: failed to verify certificate: x509: certificate signed by unknown authority

So , First , it it the right approach to Revoke my Certificate ?

If not , what should I do ? If yes , how can I make step ca trust my CA ?

Thanks a lot

[SebastienTolron]

Maybe its not the right label , or the right place for that issue sorry

[hslatman]

Hey @SebastienTolron, could you try step ca bootstrap --ca-url https://acme-server.mydomain.local --fingerprint <ca-fingerprint-shown-at-startup> before other operations? This should make step use the expected root CA for interacting with the CA.

[SebastienTolron]

Hi @hslatman thanks for the fast answer !

I tried

⚠️  It looks like step is already configured to connect to an authority.
You can use 'contexts' to easily switch between teams and authorities.
Learn more at https://smallstep.com/docs/step-cli/the-step-command#contexts.

✔ Would you like to overwrite /home/step/certs/root_ca.crt [y/n]: y
open /home/step/certs/root_ca.crt: read-only file system

I'm using helm chart and this is a volume mount.

When I run a step context list , it return nothing.

And

step-certificates-helm-0:~$ cat $(step path --base)/contexts.json
cat: can't open '/home/step/contexts.json': No such file or directory

Maybe something related to the helm chart

[SebastienTolron]

Okay so :

Changing readOnlyRootFilesystem: true to false helped.

Now , Still having an issue with context.

I had to manually write a file at /home/step/contexts.json and then I was able to bootstrap My CA.

So :

step context select mydomain
✔ Context: mydomain

step ca bootstrap --ca-url https://acme-server.mydomain.local --fingerprint  <<m<-fingerprint>>
The root certificate has been saved in /home/step/authorities/acme-server.mydomain.local/certs/root_ca.crt.
The authority configuration has been saved in /home/step/authorities/acme-server.mydomain.local/config/defaults.json.
The profile configuration has been saved in /home/step/profiles/acme-server.mydomain.local/config/defaults.json.

Then still :

step ca revoke --reason "Cert compromised" --reasonCode "key compromise" 188119706389441743186701215
client GET https://acme-server.mydomain.local/provisioners?limit=100 failed: tls: failed to verify certificate: x509: certificate signed by unknown authority

[hslatman]

Hey @SebastienTolron, sorry, this fell through the cracks.

Is step ca revoke executed on the same system where step ca bootstrap was performed? Does the root (fingerprint) saved in root_ca.crt match the one to which the CA server certificate chains? You can download the root by going to https://acme-server.mydomain.local/roots.pem in a browser (ignoring warnings, if any).

[SebastienTolron]

Same , sorry for the late answer.

• Is step ca revoke executed on the same system where step ca bootstrap was performed?

  -> Yes. I'm doing everything inside the container provided by the helm chart.

• Does the root (fingerprint) saved in root_ca.crt match the one to which the CA server certificate chains?

  -> Yes

openssl x509 -fingerprint -noout -in  <<path_downloads>>/roots.pem
SHA1 Fingerprint=E3:51:07:3B:10:28:D9:4A:46:13:DB:09:4B:4F:71:8B:03:CA:66:D3

and for the boostraped CA

kubectl cp step-certificates-helm-0:/home/step/certs/root_ca.crt  /tmp/root_ca.crt

openssl x509 -fingerprint -noout -in /tmp/root_ca.crt 
SHA1 Fingerprint=E3:51:07:3B:10:28:D9:4A:46:13:DB:09:4B:4F:71:8B:03:CA:66:D3

So yeah this seems to be ok on this.