Feature Request: Config file secrets via file paths

[especially-relative]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

In ca.json some secrets are referenced via file paths, in particular certificate files

{
  "root": "examples/pki/secrets/root_ca.crt",
  "federatedRoots": ["examples/pki/secrets/federated_root_ca.crt"],
  "crt": "examples/pki/secrets/intermediate_ca.crt",
  "key": "examples/pki/secrets/intermediate_ca_key",
  "address": ":9000",

However other secrets are not:

        "type": "OIDC",
        "name": "Google",
        "clientID": "1087160488420-8qt7bavg3qesdhs6it824mhnfgcfe8il.apps.googleusercontent.com",
        "clientSecret": "udTrOT3gzrO7W9fDPgZQLfYJ",
        "configurationEndpoint": "https://accounts.google.com/.well-known/openid-configuration",

or

{
    "type": "X5C",
    "name": "x5c",
    "roots": "LS0tLS1 ... Q0FURS0tLS0tCg==",

The ideal option, would be to have the ability to reference a file path as an alternative to the raw value by an alternative, roots/ roots_file, clientSecret/clientSecret_file and so on. These files could be injected into the container by various tooling, keeping the secrets outside of ca.json.

Why is this needed?

When deploying step-ca via IaC tools, this needs to be worked around, because the ca.json cannot be simply stored as-is. This leads to various workarounds, such as storing the entire configuration as a secret, bootstrapping the container by templates, none of which are ideal.

[alwaysalearner1234]

This would be a great improvement for IaC and containerized deployments.

Step CA already supports file-based secrets for certificates and keys, but other sensitive fields (OIDC clientSecret, X5C roots) must still be embedded directly in ca.json.

Supporting *_file alternatives (e.g., clientSecret_file, roots_file) would make configuration more secure, consistent, and easier to manage with Kubernetes, Helm, and Terraform.

Proposed behavior: if *_file is set, read the secret from disk; otherwise fall back to the inline value. Validation should prevent both from being set simultaneously.

Happy to help with implementation or testing if this direction makes sense.