Add --ca-kms flag to step certificate create

[hslatman]

The --ca-kms flag can be used to specify a different KMS to be used for the CA signer.

@maraino What are your thoughts on this? Replacing kms with caKMS is a backwards incompatible change. Not a big issue I think, because this flow is most probably used when invoking step manually. I think being able to specify a different KMS for the CA signing the certificate is useful, because the current assumption seems to be that keys will be in the same KMS. That may not be true necessarily, if someone wants their root offline (e.g. an USB token) and the intermediate to be in an online system.

An alternative would be to override the --kms flag with the value from --ca-kms if it's set. One thing that won't work in that case is when we don't specify a --ca-kms, but still want to use the SoftKMS implementation. We could catch the --ca-kms softkms: case before invoking step-kms-plugin to allow for that? Another option might be toprovide another flag (e.g. --ignore-kms) to indicate that the --kms flag must not be used as the CA KMS.

This PR includes the changes from #945 and #946.

[maraino]

As we talked, it makes sense to have both --kms and --ca-kms, one for creating the CSR and the other for signing it.

A better solution would be not to require them, but this will require changes in other places.

[hslatman]

After the changes in smallstep/crypto#240 are available here, --ca-kms may no longer be required. A key in a different KMS can then be specified using the --key <kms:>name notation. We could keep it around, though.

#946 will be merged into this first, then this PR will be updated.

[maraino]

After the changes in smallstep/crypto#240 are available here, --ca-kms may no longer be required. A key in a different KMS can then be specified using the --key kms:name notation. We could keep it around, though.

To remove the need of --ca-kms we will need to change the cryptoutil package to directly support URIs. See

cli/internal/cryptoutil/cryptoutil.go

Lines 31 to 44 in c1eb16a

	func CreateSigner(kms, name string, opts ...pemutil.Options) (crypto.Signer, error) {
	if kms == "" {
	s, err := pemutil.Read(name, opts...)
	if err != nil {
	return nil, err
	}
	if sig, ok := s.(crypto.Signer); ok {
	return sig, nil
	}
	return nil, fmt.Errorf("file %s does not contain a valid private key", name)
	}
	return newKMSSigner(kms, name)
	}

[maraino]

Add new flags at the list of flags at the beginning of UsageText.

This is not 100% backward compatible with the previous use of --kms but this might be ok. The problem is that you might need to specify both flags when before you only needed one. It was convenient for the same KMS but was problematic for cross-kms signing.

[maraino]

The current behavior is not backward compatible as the changelog says, but the help still shows examples that now will fail.

[maraino]

This change makes the command incompatible with at least one example in the help:

# Create an intermediate certificate using step-kms-plugin:

$ step kms create \
  --kms 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=password' \
  'pkcs11:id=4001;object=intermediate-key'
$ step certificate create \
  --profile intermediate-ca \
  --kms 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=password' \
  --ca root_ca.crt --ca-key 'pkcs11:id=4000' \
  --key 'pkcs11:id=4001' \
  'My KMS Intermediate' intermediate_ca.crt

[hslatman]

Fixed in 290f81d

[maraino]

lgtm