-
|
Hey there! One weird thing that I noticed is that when I generate a root cert using the Any idea why this is happening? Is there any other thing which could lead to an incorrect representation? As far as I can see, the only difference between these two certs is the signing key. See below all examples: 1. Default root-ca profile 2. Root-CA Template with RSA key 3. Cert made using built-in tool on macos, RSA
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 3 replies
-
|
Looks like the "SHA256-RSAPSS" signatureAlgorithm has something to do with this. If I issue a certificate using the default RSA algorithm (which I believe is With RSA-PSS With default RSA |
Beta Was this translation helpful? Give feedback.
-
|
I look into this before going on vacations, and the conclusion I arrived was similar, looks to me like a macOS issue. |
Beta Was this translation helpful? Give feedback.
-
|
Hi there. I've been struggling for days on that topic. I need to deploy a PKI using step-ca in an environment where a have a lot of MacOS clients. I also followed the procedure ( https://smallstep.com/docs/tutorials/rsa-chain/#introduction ) to configure step-ca with a RSA chain and it leads to the same behavior: the cert isn't recognized as being a root CA... This happens at least on Safari, works perfectly on Firefox for instance. That being said, what do I need to do? Cheers |
Beta Was this translation helpful? Give feedback.
-
|
Hi @BHuck74, First, I'd suggest filing a Feedback with Apple about the issue. Next, here's an idea for you that may work. From the introduction of the tutorial:
If you're comfortable using RSA PKCS#1 v1.5 instead of an RSA-PSS CA, you can create your CAs like this: and If you try this and find that it is properly recognized on recent macOS versions, will you let me know? |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @tashian for your answer. For sure I will give it a try and let you know! That being said, I must admit I rushed headlong deploying RSA type CA, but I didn't try ECDSA first. My usage is only server / client X509 certs issuance in an LAN environment with Mac OS / Linux clients, and Debian based servers, NAS, ESXi, ... I'm not a cert topic expert, so I don't know. Cheers! |
Beta Was this translation helpful? Give feedback.
-
|
Dear @tashian, I did try to create a root and intermediate key as per you recommendation, and it works fine on MacOS clients (also tested on iPhone). I just added a duration constraint but the rest did the trick. By the way, the native root and intermediate cert was also recognized, but I encountered error with server certs generated with this authority (in particular on Unifi UDM pro for instance). step certificate create "Test Authority Root CA" \
$(step path)/certs/root_ca.crt \
$(step path)/secrets/root_ca_key \
--profile root-ca \
--kty RSA \
--not-after 175320h \
--size 3072step certificate create "Test Authority Intermediate CA" \
$(step path)/certs/intermediate_ca.crt \
$(step path)/secrets/intermediate_ca_key \
--profile intermediate-ca \
--ca $(step path)/certs/root_ca.crt \
--ca-key $(step path)/secrets/root_ca_key \
--kty RSA \
--not-after 87660h \
--size 3072Cheers |
Beta Was this translation helpful? Give feedback.
Looks like the "SHA256-RSAPSS" signatureAlgorithm has something to do with this.
If I issue a certificate using the default RSA algorithm (which I believe is
RSASSA-PKCS-v1.5 using SHA-256), the certificate is seen as a root cert by macos.If I instead follow the docs and set the
"signatureAlgorithm": "SHA256-RSAPSS"key, then the certificate is seen as an intermediate from MacOS.With RSA-PSS