Skip to content

feat: add --intermediate-file flag to step ca certificate - #1692

Closed
francisreboucas wants to merge 1 commit into
smallstep:masterfrom
francisreboucas:feat/ca-certificate-intermediate-file
Closed

feat: add --intermediate-file flag to step ca certificate#1692
francisreboucas wants to merge 1 commit into
smallstep:masterfrom
francisreboucas:feat/ca-certificate-intermediate-file

Conversation

@francisreboucas

Copy link
Copy Markdown

Summary

Add a new --intermediate-file flag to step ca certificate that writes the intermediate certificate chain to a separate file, while the leaf certificate is written to the main certificate file.

Motivation

Some clients don't accept full certificate chains and require the leaf and intermediate certificates in separate files. This is a common pattern when working with reverse proxies, load balancers, or other TLS-terminating infrastructure.

Closes #1360

Changes

  • flags/flags.go: Added IntermediateFile flag definition
  • command/ca/certificate.go: Added --intermediate-file to the command flags, usage text, and examples
  • utils/cautils/certificate_flow.go: Added SignWithIntermediate method that splits the certificate chain when an intermediate file path is provided. The original Sign method is preserved for backward compatibility.

Usage

$ step ca certificate foo.internal foo.crt foo.key --intermediate-file intermediate.crt

This will:

  • Write the leaf certificate to foo.crt
  • Write the intermediate chain to intermediate.crt

Without the flag, behavior is unchanged (full chain in foo.crt).

Testing

All existing tests pass:

ok  github.com/smallstep/cli/command/ca
ok  github.com/smallstep/cli/utils/cautils
ok  github.com/smallstep/cli/flags

Add a new --intermediate-file flag to 'step ca certificate' that writes
the intermediate certificate chain to a separate file, while the leaf
certificate is written to the main certificate file.

This is useful for clients that don't accept full certificate chains and
require the leaf and intermediate certificates in separate files.

Closes smallstep#1360
@CLAassistant

CLAassistant commented Aug 26, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@github-actions github-actions Bot added the needs triage Waiting for discussion / prioritization by team label Aug 26, 2026
@francisreboucas

Copy link
Copy Markdown
Author

Closing in favor of #1438 which implements the same feature. Sorry for the duplicate!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs triage Waiting for discussion / prioritization by team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add an option to step ca certificate to output the leaf and intermediate chain in separate files.

3 participants