Certificate expiration date later than subCA expiration date

Certificate expiration date after subCA expiration date

step-ca issue certificates with expiration date later than the expiration date of the subCA issuing it.

Your environment

• OS - Ubuntu 18.04
• Version - v0.14.6

Steps to reproduce

Create a subCA (we didn't test with a root CA) with a short expiration date. Configure the subCA as an ACME provisioner, with a maxTLSCertDuration that will allow the provisioner to issue certificate with a expiration date later than the expiration date of the subCA. Request such a certificate. Check the leaf certificate expiration date.

Expected behaviour

step-ca should not issue certificates with expiration date later than the expiration date of the subCA issuing it. The expiration date of certificates should be limited by the expiration date of the certificate of the intermediate CA.

Actual behaviour

step-ca issue certificates with expiration date later than the expiration date of the subCA issuing it.

Additional context

We use only an ACME provisioner. We had the problem with at least Caddy and lego as ACME client.