Intro templates to allow x509 cert flexibility [L]

[sourishkrout]

• functionality for x509
• test suite for x509
• step certificate create --create
• Incorporate feedback

(cli changes not covered in here)

Breakdown:

1. Go from CSR/attributes denylist to allowlist for CA
2. Can we use template as de facto whitelist?

[maraino]

@mkkeffeler in Gitter requested if it's is possible to add extra SANs not present in the CSR. For example, the JWK token can have the SANs foo.bar, foo.zar but the CSR won't have any.

[TheSecMaven]

This is a must have that @maraino mentioned because lots of clients don't know how to request SANS easily in their CSRs, so in the spirit of making TLS easier this would be a HUGE feature add.

[TheSecMaven]

Also related to #45 which was closed in favor of this

[dwchurch]

this is helpful because we often need to add specific things that our clients don't know to add

[alogishetty]

This would be very helpful to have this!

[nhogan5]

We need this too! Would stream line our client on-boarding process tremendously.

[alexw19]

Would like to see this implemented. Would be very helpful!

[TheSecMaven]

An additional use case is for adding EMAIL contacts to ACME certificates. IP and DNS sans definitely need to be validated against standard ACME protocol, but email contacts should be able to be added to an ACME certificate

-bash-4.2$ sudo step ca certificate test:10443 foo.crt foo.key --provisioner=my-acme-provisioner --http-listen :10443 --standalone --kty RSA --san testemail@gmail.com
✔ Provisioner: my-acme-provisioner (ACME)
IP Address and Email Address SANs are not supported for ACME flow
-bash-4.2$

[maraino]

X.509 templates functionality is currently in the master branch of certificates. The cli part will be there soon.
This will be officially released probably next week with v0.15.0 while ssh-certificates will probably come with v0.15.1