maxTLSCertDuration not work

[ilbunilcho]

step cli on ubuntu 24.04

$ cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.3 LTS"

$ step -v
Smallstep CLI/0.28.7 (linux/amd64)
Release Date: 2025-07-14T04:10:42Z

step server on docker with local mounted volume

claims setting in ca.json

        "authority": {
                "claims": {
                        "maxTLSCertDuration": "120m",
                        "defaultTLSCertDuration": "120m",
                        "maxHostSSHCertDuration": "120m",
                        "defaultHostSSHCertDuration": "120m",
                        "maxUserSSHCertDuration": "120m",
                        "defaultUserSSHCertDuration": "120m"
                },
                "enableAdmin": true
        },

run step health

$ step ca health
ok

run step to create server.crt

$ step ca certificate foo server.crt server.key --not-after=120m

✔ Provisioner: root (JWK) [kid: ...]
Please enter the password to decrypt the provisioner key: 
✔ CA: https://...:9000
✔ Would you like to overwrite server.crt [y/n]: y
✔ Would you like to overwrite server.key [y/n]: y
✔ Certificate: server.crt
✔ Private Key: server.key

check server.crt

$ step certificate inspect server.crt 

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 148015224330370270140736193321168053036 (0x6f5ab1fda0c17c5030d6a2a0ebaca32c)
    Signature Algorithm: ECDSA-SHA256
        Issuer: O=...,CN=...
        Validity
            Not Before: Nov 1 06:59:34 2025 UTC
            Not After : Nov 1 08:59:34 2025 UTC

server logs

time="2025-11-01T16:00:34+09:00" level=info certificate="..."
duration=110.250506ms duration-ns=110250506 fields.time="2025-11-01T16:00:34+09:00"
issuer="... Intermediate CA"
method=POST name=ca ott=... path=/sign protocol=HTTP/2.0
provisioner="root (...)" public-key="ECDSA P-256" referer= remote-address=...
request-id=8fe98402-d5aa-401e-bbeb-31f21f2a6fe5
sans="map[dns:[...] ip:[...]]"
serial=148015224330370270140736193321168053036 size=4357 status=201
subject=nas400 user-agent="Smallstep CLI/0.28.7 (linux/amd64)" user-id=
valid-from="2025-11-01T06:59:34Z" valid-to="2025-11-01T08:59:34Z"

checked with local and server step cli
both version are same

anything worng?

[ilbunilcho]

120m was intended to be 120 months, but 120m was correctly processed as 120 minutes.

The formats supported in the settings claims are h, m, s, which uses go's time.Duration.

It would be nice to see some mention of this in the configuration documentation (https://smallstep.com/docs/step-ca/configuration/#basic-configuration-options)

[tashian]

Thanks for the feedback, I'll add that to the docs!