how to use root_ca.crt to issue a certificate directly

[ac169]

currently step-ca issuing certificates through intermediate_ca.crt. This kind of certificate issuing certificates issued by intermediate certificates. Even if root_ca.crt has been imported into the client trust domain, it still cannot be verified. You must import intermediate_ca.crt into the client, which is too much work.

Trying to modify the following, but failed

/config/ca.json

{
  "root": "certs/root_ca.crt",
  "federatedRoots": null,
  "crt": "certs/root_ca.crt",
  "key": "secrets/root_ca_key",
  ...
}

[kve-occ]

This is quite normal behavior. Most Public certificates will not only contain the leaf (server) certificate, but also the intermediate certificate of the authority (a certificate bundle).

For a proper chain verification, the entire chain needs to be present. Either in the system trust-store or in the certificate bundle.

---

What exactly were you trying to modify in that part? In our, quite standard, installation, step-ca issues certificate bundles, which contain the intermediate certificate.

Your issue could be caused by the crt: and key: fields containing the root certificate and key, not the intermediate:

  "root": "/home/step/certs/root_ca.crt",
  "crt": "/home/step/certs/intermediate_ca.crt",
  "key": "/home/step/secrets/intermediate_ca_key",

From the docs:

crt: location of the intermediate certificate on the filesystem. The intermediate certificate is returned alongside each new certificate, allowing the client to complete the certificate chain. Multiple intermediates are allowed here. When multiple intermediates are supplied, the first certificate in the PEM bundle must be the one used for signing.

key: location of the intermediate private key on the filesystem. The intermediate key signs all new certificates generated by the CA.