OPCUA valid certificates

[deweil]

I'm trying to create certificates mit step ca which are valid for OPCUA Servers.
Therefore I created a new provisioner with an attached template which requires to set the basicConstraint isCA extension to FALSE:

   {
       "subject": {{ toJson .Subject }},
       "sans": {{ toJson .SANs }},
        "basicConstraints": {
             "critical": true,
             "isCA": false
       },
      "keyUsage": ["digitalSignature", "keyEncipherment", "keyAgreement", "certSign"],
      "extKeyUsage": ["serverAuth", "clientAuth"]
   }

The problem is, the created certificate doesn't include the basicConstraint extension which is necessary for some OPCUA Servers.
Is there is way to include the basicConstraint CA:FALSE in the certificate?

The open62541 library with the focus on OPCUA includes the CA:FALSE which get the certificates accepted by the OPCUA server.

[maraino]

Hi @deweil, I've been looking at this, and is a problem with our template library, that we only introduce that extension if isCA is true. It should be easy to change the behavior to fix it.

[maraino]

@deweil I've fixed the issue in smallstep/crypto#12 and updated step-ca and step to use it.
You'll need to manually build them until we create a release.

[deweil]

Thanks for the quick response and action!