Intermediate CA not renewed on clients

[Szparki]

I had a situation where the certificate was renewed on the clients but the intermediate CA was not. With this I ended up with bunch of servers having an outdated certificate chain and had to regenerate them by hand. I have two servers behind the step ca domain.

• the certificates were JWK
• step ca server is: step-certificates-0.28.1_2 on both step servers
• the clients were running multiple step ca versions on BSD or Linux, from two year old up to the latest, same everywhere
• the intermediate CA was updated on the servers and the service was restarted, new certificates received the new intermediate CA
• config/ca.json has the correct certificate paths

Any ideas what might have caused this?

[Szparki]

Update, I think the issue is that step ca issued certificates which were valid after the intermediate CA expiration time. With that step cli didn't refresh them.

[Szparki]

I might be hitting the same issue as discussed here

[Szparki]

If we could set maxTLSCertDuration to a specific date, then we could set it to the expiration date of the intermediate CA

[Szparki]

Another option would be changing maxTLSCertDuration and defaultTLSCertDuration for example a month and refresh the intermediate CA within 5 weeks before expiration.
However when I issue step ca renew on the clients the refreshed certificates lifetime will be the same as the original certificate and not the one specified in maxTLSCertDuration and defaultTLSCertDuration. Is there a way of changing this behavior?