localhost SAN not allowed on leaf certs?

[tai-ss]

When I try to use step ca certificate to create a leaf certificate with a SAN including localhost, the JWK provisioner returns:

The request was forbidden by the certificate authority: dns name "localhost" not allowed

I don't understand why the JWK provisioner blocked this. How do I override this?

[pratikrath126]

Hey! This is a default security restriction in step-ca. By default, the CA will not issue certificates for special names like localhost to prevent accidental or malicious local service interception.

To override this, you need to update your ca.json configuration for the specific provisioner. You can add a claims section to the provisioner configuration to allow specific DNS names. For example, in your ca.json:

"provisioners": [
{
"type": "JWK",
"name": "your-provisioner",
"claims": {
"allowNames": {
"dns": ["localhost"]
}
}
}
]

After updating ca.json, restart the step-ca service. This explicitly tells the CA that this provisioner is permitted to sign certificates for the localhost identifier. Hope this helps!

[tai-ss]

This doesn't work, because the provisioner config is stored in the DB, not ca.json.