Add CSR common name to SANs if no other SANs are defined in CSR (#1172)

* Add CSR common name to SANs if no other SANs are defined in CSR

Author: dopey

command/certificate/sign.go

@@ -37,8 +37,8 @@ func signCommand() cli.Command {
 		Action: cli.ActionFunc(signAction),
 		Usage:  "sign a certificate signing request (CSR)",
 		UsageText: `**step certificate sign** <csr-file> <crt-file> <key-file>
-[**--profile**=<profile>] [**--template**=<file>] 
-[**--set**=<key=value>] [**--set-file**=<file>]
+[**--profile**=<profile>] [**--template**=<file>]
+[**--set**=<key=value>] [**--set-file**=<file>] [**--omit-cn-san**]
 [**--password-file**=<file>] [**--path-len**=<maximum>]
 [**--not-before**=<time|duration>] [**--not-after**=<time|duration>]
 [**--bundle**]`,
@@ -79,6 +79,11 @@ Sign a CSR with custom validity and bundle the new certificate with the issuer:
 $ step certificate sign --bundle --not-before -1m --not-after 16h leaf.csr issuer.crt issuer.key
 '''
 
+Sign a CSR but do not add the Common Name to the SANs extension of the certificate:
+'''
+$ step certificate sign --omit-cn-san leaf.csr issuer.crt issuer.key
+'''
+
 Sign an intermediate ca:
 '''
 $ step certificate sign --profile intermediate-ca intermediate.csr issuer.crt issuer.key
@@ -174,6 +179,14 @@ $ step certificate sign \
 			flags.Template,
 			flags.TemplateSet,
 			flags.TemplateSetFile,
+			cli.BoolFlag{
+				Name: "omit-cn-san",
+				Usage: `Do not add CSR Common Name as SAN extension in resulting certificate.
+By default, the CSR Common Name will be added as a SAN extension only if the CSR
+does not contain any SANs. Note that if the Common Name is already captured as a
+SAN extension in the CSR then it will still appear as a SAN extension in the
+certificate.`,
+			},
 			flags.PasswordFile,
 			cli.StringFlag{
 				Name: "not-before",
@@ -327,7 +340,7 @@ func signAction(ctx *cli.Context) error {
 	}
 
 	// Create certificate template from csr.
-	data := createTemplateData(csr, maxPathLen)
+	data := createTemplateData(csr, maxPathLen, ctx.Bool("omit-cn-san"))
 	data.SetUserData(userData)
 	tpl, err := x509util.NewCertificate(csr, x509util.WithTemplate(template, data))
 	if err != nil {
@@ -424,7 +437,7 @@ func validateIssuer(crt *x509.Certificate, profile string, maxPathLen int) error
 // createTemplateData create a new template data with subject and sans based on
 // the information in the certificate request, and the maxPathLen for
 // intermediate certificates.
-func createTemplateData(cr *x509.CertificateRequest, maxPathLen int) x509util.TemplateData {
+func createTemplateData(cr *x509.CertificateRequest, maxPathLen int, omitCNSAN bool) x509util.TemplateData {
 	var sans []string
 	sans = append(sans, cr.DNSNames...)
 	sans = append(sans, cr.EmailAddresses...)
@@ -435,6 +448,10 @@ func createTemplateData(cr *x509.CertificateRequest, maxPathLen int) x509util.Te
 		sans = append(sans, v.String())
 	}
 
+	if !omitCNSAN && len(sans) == 0 && cr.Subject.CommonName != "" {
+		sans = append(sans, cr.Subject.CommonName)
+	}
+
 	data := x509util.NewTemplateData()
 	data.SetCertificateRequest(cr)
 	data.Set("MaxPathLen", maxPathLen)