[Bug]: `v0.25.0` causes error (`error reading <kms_id/alias>: no such file or directory`) when signing intermediate CA certificate w/ AWS KMS about cli

[maraino]

Hi @ianhundere, the problem here is that this version introduced the --ca-kms flag (PR #942) to allow cross-kms signs, and it is required if your CA key is in a KMS.

This command should work:

step certificate create --template intermediate.tpl --not-after 876000h\
  --kms 'awskms:region=us-east-1' \
  --ca-kms 'awskms:region=us-east-1' \
  --ca root_ca.crt --ca-key 'awskms:key-id=alias/<root_ca_kms_alias>' \
  --key 'awskms:key-id=alias/<intermediate_ca_kms_alias>' \
  "Intermediate CA" intermediate_ca.crt

[maraino]

Don't worry, we don't have an easy way to announce those breaking changes.

[ianhundere]

@maraino ah, sorry for the oversight / thanks for pointing that out.