The Issue

The --cert flag is used to make the certificate as the user defines, but the user messaging is pulling the named file from somewhere else.

Example

anser@computername:/data/tmp/test$ certstrap sign IntermediateGoose \
     --expires "1 year" \
     --CA Root \
     --csr csr/IntermediateGoose.csr \
     --cert out/LooseGoose.crt \
     --intermediate \
     --path-length "1"

Replies with:

Building intermediate
Created out/IntermediateGoose.crt from out/IntermediateGoose.csr signed by out/Root.key

The "Created out/IntermediateGoose.crt" is False. It is not created. Instead (and as instructed) the created cert is out/LooseGoose.crt.

It should read: Created out/LooseGoose.crt from out/IntermediateGoose.csr signed by out/Root.key, as that is what it actually created.

System Parms

OS: Ubuntu 22.04.4 LTS
go: go1.18.1 linux/amd64
certstrap: version 1.3.0