User-id parameter?

[Rapt88]

Hi,

I'm looking through the terminal on the CA, and I can see that there's a field in the test called "user-id", but it's never populated. I've also been looking through the documentation "https://smallstep.com/docs/step-cli/reference/ca/certificate" and cant see a reference to this.

Can you elaborate on how to populate this with a string? We may be able to use this, if we can populate it.

The purpose would be to connect the creation text on the CA to the renewal text on the CA, when creating and renewing certificates because nothing is consistent between the creation and renewal. Therefore if we can populate this, it may provide that consistency per task to connect a certificate that was created with it's renewal.

extract "status=201 subject=forename-surname user-agent=Go-http-client/1.1 user-id= valid-from="2020-11-09T09:32:56Z" valid-to="2020-11-10T09:33:56Z"

[maraino]

Hi @Rapt88, we don't populate the user-id, this field is there because the logging package started in a different internal product that was using it.

At some point, we'll replace the logging in step-ca with a new logging package I've been working for internal products
https://github.com/smallstep/logging. If you look at the code, there's also a user-id, but this is to support the CommonLogFormat encoder, that I added there for backward compatibility with the log formats supported in step-ca.

[mmalone]

The public key in the issued certificate is the same on renewal. That might help?

[maraino]

The certificates in the logs are the base64 of a certificate in DER format, you can for example check two keys using its fingerprint:

$ echo MIICNDCCA.... | base64 -d | step certificate format - | step crypto key fingerprint
SHA256:A3ErVuSjLtQRqxhmMEnfxceoKKAqayMfhICYakzMdug
$ echo MIICNTCCA... | base64 -d | step certificate format - | step crypto key fingerprint
SHA256:A3ErVuSjLtQRqxhmMEnfxceoKKAqayMfhICYakzMdug

[Rapt88]

Thanks guys the command maraino provided, works. One small change though, is that I had to use a lowercase d on the base64 part. Uppercase wasn't recognized. Making that clarity for anyone in future who reads this.

[maraino]

Fixed, old versions of macOs base64 only supported -D, but now they support both -d and -D, but I should have used step base64 -d 😄