[Bug]: Invalid JSON when applying template data to provisioner makes ca.json empty

[mirex05]

Steps to Reproduce

Try to add provisioner using step CLI with invalid JSON template:

step ca provisioner add acme --type ACME --force-cn --x509-template-data templates/acme-default.tpl --include-root

acme-default.tpl (with missed quoting at issuer field value):

{
	"subject": {
        "country": "US",
        "organization": "ACME Corp",
        "organizationalUnit": "ACME Team",
        "commonName": "{{ toJson .Subject.CommonName }}"
    },
	"issuer": {{ toJson .Subject.CommonName }},
	"keyUsage": ["keyEncipherment", "digitalSignature"],
	"extKeyUsage": ["serverAuth", "clientAuth"]
}

Your Environment

• OS - Debian 12
• step CLI Version - 0.24.4 (linux/amd64)

Expected Behavior

Only error output by step CLI, without any modifications to ca.json.

Actual Behavior

Error output by step CLI:
error writing /etc/step-ca/.step/config/ca.json: json: error calling MarshalJSON for type json.RawMessage: invalid character '{' looking for beginning of object key string
and ca.json becomes empty.

Additional Context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[maraino]

Hi @mirex05, this is definitively a bug. Are you trying to set the template data or just a template?

If it is a template, it probably should be:

{
  "subject": {
    "country": "US",
    "organization": "ACME Corp",
    "organizationalUnit": "ACME Team",
    "commonName": {{ toJson .Subject.CommonName }}
  },
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
  "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
  "keyUsage": ["digitalSignature"],
{{- end }}
  "extKeyUsage": ["serverAuth", "clientAuth"]
}

The "issuer" will always be overwritten when we sign the certificate, so you don't really need it. The common name should be without quotes because you are using toJson, and the key usage keyEncipherment is only for RSA keys.

It doesn't make sense to use the template data without a template. The template data is information that you add in the ca.json that can be consumed by a template, for example, with this template data:

"templateData": {
  "country": "US",
  "organization": "Acme Corp.",
  "organizationalUnit": "Coyote"
}

You can create a template that sets the subject like this:

{
  "subject": {
    "country": {{ toJson .country }},
    "organization": {{ toJson .organization }},
    "organizationalUnit": {{ toJson .organizationalUnit }},
    "commonName": {{ toJson .Subject.CommonName }}
  },
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
  "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
  "keyUsage": ["digitalSignature"],
{{- end }}
  "extKeyUsage": ["serverAuth", "clientAuth"]
}

The toJson function is not really required. You can do "{{ .country }}", but it sanitizes the data in the variables so nothing unexpected is injected.

[mirex05]

Hi @maraino, currently it's only a lab before setting up step CA to production, so i just doing some experiments and see how it works. Thanks for detailed explanation about the difference between template and template data, now it's definitely clear to me what should i use.