feat(cli): Display certificate validity warnings

[aw1cks]

Name of feature:

Show CA certificate-validity warnings in the CLI.

Pain or issue this feature alleviates:

The CA can successfully issue a certificate with a shorter lifetime than requested because its issuing chain expires sooner. The CLI currently discards the warning explaining that reduction.

This change prints the CA's warnings on stderr after handling the returned credentials. It keeps certificate output separate and does not treat a failed warning write as an issuance failure.

Why is this important to the project (if not answered above):

A successful command should still tell users when they received a shorter-lived certificate. Displaying the warning makes the reason visible where they requested it, without requiring access to CA logs.

Is there documentation on how to use this feature? If so, where?

The CA and SSH command help and changelog describe when warnings appear. The companion certificates PR documents the server policy.

In what environments or workflows is this feature supported?

• Native step ca certificate, sign, renew, and rekey, including offline X.509 operations and renewal daemons.
• Newly issued admin identities.
• SSH certificate, login, renewal, and rekey operations that also issue an X.509 identity, including implicit proxy login and login after an unauthorized response.

In what environments or workflows is this feature explicitly NOT supported (if any)?

This does not add warnings to the ACME fallback, standalone step certificate create/sign, or offline SSH operations that do not issue an X.509 identity. It does not change SSH validity or renewal scheduling.

Warning writes tolerate unavailable stderr, including Unix broken pipes. Other CLI status messages retain their existing behavior.

Dependency and merge order:

This draft depends on smallstep/certificates#2820. The CLI still pins certificates v0.30.2, so it cannot build independently until a release containing the new warning fields is available and pinned here. Verification currently uses a Go workspace containing both branches.

Verification:

After checking both branches against current upstream, the full short suites passed in that workspace and both binaries built. Regression tests cover broken stderr and both implicit SSH login paths with real CA issuance. Focused race checks and lint also passed during feature verification.

Supporting links/other PRs/issues:

• Related issues: Certificate expiration date later than subCA expiration date certificates#381 and Constrain lifetime of signed certificate by remaining lifetime of parent certificates. certificates#560
• Server implementation: feat: Enforce issuer validity limits and warnings certificates#2820

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}