Step certificate not encrypting key?

[sjtbham]

When using the step ca certificate command and passing the password-file, the key that is generated appears not to be encrypted with the password file. Am I doing something wrong with this or misread the docs?

$ step ca certificate --kty EC --not-after=96h --token=$TOKEN --provisioner=provisionername --password-file=/path/to/pwdfile.txt host.fqdn host.pub host.prv
✔ CA: https://ca.url
✔ Certificate: host.pub
✔ Private Key: host.prv

$ grep ENCRYPTED host.prv

I would expect the key to be encrypted with the password-file, and so contain e.g.: Proc-Type: 4,ENCRYPTED in the keyfile?

[sjtbham]

If I get the key as above and then do e.g.

$ openssl ec -in host.prv -out host.prv -aes256 -passout file:/path/to/pwdfile.txt
read EC key
writing EC key

and then operations like:

$ step ca renew host.pub host.prv --password-file=/path/to/pwdfile.txt -force
Your certificate has been saved in host.pub.

work OK

[maraino]

Hi @sjtbham, --password-file in step ca certificate was defined, but it never had any effect, it was just added as a hack to support the --provisioner-password-file flag. In master, this hack has now been fixed, and --password-file has been removed.

step ca certificate has never supported encrypting the key, right now you can for example use step crypto change-pass my.key for this purpose. We can also consider adding the functionality that you're suggesting using the now available --password-file