Add step certificate unbundle subcommand for separating certificate chains #1437

Activity

1. dopey

   added

   enhancement

   needs triageWaiting for discussion / prioritization by teamWaiting for discussion / prioritization by team

   on Jun 11, 2025
2. maraino commented on Jun 11, 2025

   

   maraino

   on Jun 11, 2025

   Collaborator

   More actions

   Instead of using the --out flag, we could use the number of arguments:

   # Print the leaf
   step certificate unbundle chain.crt
   step certificate unbundle --leaf chain.crt
   
   # Write the leaf in leaf.crt
   step certificate unbundle chain.crt leaf.crt
   step certificate unbundle --leaf chain.crt leaf.crt
   
   # Print list of intermediates
   step certificate unbundle --intermediate chain.crt
   
   # Write the intermediates in intermediate.crt
   step certificate unbundle --intermediate chain.crt intermediate.crt
   
   # Write the leaf in leaf.crt and intermediate in intermediate.crt
   step certificate unbundle chain.crt leaf.crt intermediate.crt
   

   Alternatively instead of using the --out flag we could use --leaf leaf.crt and --intermediate.crt if we want to be more explicit.
3. aliamerj commented on Jun 11, 2025

   

   aliamerj

   on Jun 11, 2025

   More actions

   Hey @dopey! 👋

   I just finished a PR (#1438) adding --intermediate-file to split certs during generation.

   This unbundle command looks like the perfect companion for existing files! Happy to tackle it next if you want.

   Same cert-chain logic I just implemented, so I can move fast. Let me know!
4. hslatman commented on Jun 11, 2025

   

   hslatman

   on Jun 11, 2025

   Member

   More actions

   While slightly more typing is involved, I have a preference for the initially suggested flags, as there's less room for guessing which file comes in which order. I'd say adding --out is fine, since we're already using that in a few places, but it's effectively the same as redirection using >.
5. hslatman

   assigned

   dopey

   on Jun 17, 2025