What would you like to be added
Right now step certificate inspect --bundle displays the leaf and the intermediate certs. It would be nice if it could also display the root.
Why this is needed
We just ran into an issue where TLS connections were failing with a message about an expired certificate. However, the expiration date in the error message didn't match the date shown for the server cert at all. Both the server leaf cert and intermediate cert were still valid. It wasn't until looking at the certs with openssl that we noticed the root certificate was actually expired.
Including the root in --bundle would have made debugging this very straightforward.
Edit: I'm specifically referring to step certificate inspect on a URL, not a PEM file.
What would you like to be added
Right now
step certificate inspect --bundledisplays the leaf and the intermediate certs. It would be nice if it could also display the root.Why this is needed
We just ran into an issue where TLS connections were failing with a message about an expired certificate. However, the expiration date in the error message didn't match the date shown for the server cert at all. Both the server leaf cert and intermediate cert were still valid. It wasn't until looking at the certs with
opensslthat we noticed the root certificate was actually expired.Including the root in
--bundlewould have made debugging this very straightforward.Edit: I'm specifically referring to
step certificate inspecton a URL, not a PEM file.