download intermediate certificate

[conloos]

Hello @ALL,

I have, as suggested, created a ca with intermediate. I transferred the root certificate to the system keystore with step-cli ca root [...] and step-cli certificate install [...].
How can I download the intermediate certificate, to install it too, because i have apps they need the whole chain.
Or does it have to be distributed in a different way?

Thanks Frank

[maraino]

Hi @conloos, we don't have an endpoint that returns the intermediate certificate, but this is available in any certificate returned by step-ca, and it's even in the response of any request.

One easy way to get it is by inspecting the certificate of your CA:

$ step certificate inspect --bundle --format pem https://my.ca
-----BEGIN CERTIFICATE-----
MII... THIS IS THE SERVER CERTIFICATE
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MII... THIS IS THE INTERMEDIATE CERTIFICATE
-----END CERTIFICATE-----

This commands works for me because I have my root in my system keystore, you also have it, so it should work for you too, changing the CA endpoint. But if you don't have it, you can pass it using the flag --roots root_ca.crt or by trusting anything using the flag --insecure.

[tashian]

For posterity, here's a version that pulls only the intermediate CA into a file:

step certificate inspect https://my.ca \
        --roots "root_ca.crt" --format pem --bundle | \
  awk 'split_after==1{n++;split_after=0}
       /-----END CERTIFICATE-----/{split_after=1}
      n==1{print > "intermediate_ca.crt"}'