[Bug]: Invalid JSON when applying template data to provisioner makes ca.json empty about cli

[maraino]

Hi @mirex05, this is definitively a bug. Are you trying to set the template data or just a template?

If it is a template, it probably should be:

{
  "subject": {
    "country": "US",
    "organization": "ACME Corp",
    "organizationalUnit": "ACME Team",
    "commonName": {{ toJson .Subject.CommonName }}
  },
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
  "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
  "keyUsage": ["digitalSignature"],
{{- end }}
  "extKeyUsage": ["serverAuth", "clientAuth"]
}

The "issuer" will always be overwritten when we sign the certificate, so you don't really need it. The common name should be without quotes because you are using toJson, and the key usage keyEncipherment is only for RSA keys.

It doesn't make sense to use the template data without a template. The template data is information that you add in the ca.json that can be consumed by a template, for example, with this template data:

"templateData": {
  "country": "US",
  "organization": "Acme Corp.",
  "organizationalUnit": "Coyote"
}

You can create a template that sets the subject like this:

{
  "subject": {
    "country": {{ toJson .country }},
    "organization": {{ toJson .organization }},
    "organizationalUnit": {{ toJson .organizationalUnit }},
    "commonName": {{ toJson .Subject.CommonName }}
  },
{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
  "keyUsage": ["keyEncipherment", "digitalSignature"],
{{- else }}
  "keyUsage": ["digitalSignature"],
{{- end }}
  "extKeyUsage": ["serverAuth", "clientAuth"]
}

The toJson function is not really required. You can do "{{ .country }}", but it sanitizes the data in the variables so nothing unexpected is injected.

[mirex05]

Hi @maraino, currently it's only a lab before setting up step CA to production, so i just doing some experiments and see how it works. Thanks for detailed explanation about the difference between template and template data, now it's definitely clear to me what should i use.