[Bug]: v0.25.0 causes error (error reading <kms_id/alias>: no such file or directory) when signing intermediate CA certificate w/ AWS KMS

[ianhundere]

Steps to Reproduce

We are currently using 0.24.4 of step-cli because there's an issue with v0.25.0 that causes the following error when trying to sign an intermediate CA certificate:

error reading <kms_id/alias>: no such file or directory

^ example of command being run:
step certificate create --template intermediate.tpl --not-after 876000h --kms 'awskms:region=us-east-1' --ca root_ca.crt --ca-key 'awskms:key-id=alias/<root_ca_kms_alias>' --key 'awskms:key-id=alias/<intermediate_ca_kms_alias>' "Intermediate CA" intermediate_ca.crt

Your Environment

• OS - macos 14.0 (23A344)
• step CLI Version - v0.25.0

Expected Behavior

output should be Your certificate has been saved in intermediate_ca.crt.

Actual Behavior

error reading <kms_id/alias>: no such file or directory

Additional Context

intermediate.tpl

{
  "subject": {
    "commonName": "test"
  },
  "issuer": {
    "commonName": "test"
  },
  "keyUsage": [
    "certSign",
    "crlSign"
  ],
  "extKeyUsage": [
    "CodeSigning"
  ],
  "basicConstraints": {
    "isCA": true,
    "maxPathLen": 0
  }
}

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[maraino]

Hi @ianhundere, the problem here is that this version introduced the --ca-kms flag (PR #942) to allow cross-kms signs, and it is required if your CA key is in a KMS.

This command should work:

step certificate create --template intermediate.tpl --not-after 876000h\
  --kms 'awskms:region=us-east-1' \
  --ca-kms 'awskms:region=us-east-1' \
  --ca root_ca.crt --ca-key 'awskms:key-id=alias/<root_ca_kms_alias>' \
  --key 'awskms:key-id=alias/<intermediate_ca_kms_alias>' \
  "Intermediate CA" intermediate_ca.crt

[ianhundere]

@maraino ah, sorry for the oversight / thanks for pointing that out.

[maraino]

Don't worry, we don't have an easy way to announce those breaking changes.