Add --token-file support to step ca certificate

[YuukiRitoTeng]

Name of feature:

Add --token-file support to step ca certificate.

Pain or issue this feature alleviates:

step ca token can already write a one-time token to disk with --output-file, but step ca certificate only accepted an externally generated token directly through --token.

This change allows automation to pass the same token from a file without shell substitution or command-line token interpolation.

Why is this important to the project (if not answered above):

It makes token handoff more convenient for scripted workflows while preserving the existing certificate issuance flow and token semantics.

Is there documentation on how to use this feature? If so, where?

Yes. The command UsageText/help is updated, and the change is documented in CHANGELOG.md.

In what environments or workflows is this feature supported?

Online step ca certificate flows that currently accept an externally supplied --token.

The token file is read using the existing file-reading utility, surrounding whitespace is trimmed, and the resolved token continues through the existing certificate issuance flow.

Existing --token behavior remains unchanged.

In what environments or workflows is this feature explicitly NOT supported (if any)?

--token-file is mutually exclusive with --token and incompatible with --offline, matching the semantics of an externally supplied token.

For JWK tokens, explicit --token-file input follows the same --san validation as explicit --token input. Other supported external token types retain their existing SAN behavior.

An empty or whitespace-only token file returns an error and does not fall back to automatic token generation.

The supplied token file is not deleted or modified; its lifecycle remains the caller's responsibility.

Supporting links/other PRs/issues:

Refs #1435

Related historical attempt: #1625.

This version specifically addresses the edge cases identified in the earlier attempt, including:

• empty or whitespace-only token files
• missing or unreadable token files
• --token and --token-file conflicts
• --offline and --token-file conflicts
• JWK token + --san behavior
• preserving existing --token behavior
• preserving automatic token generation when no external token is supplied

Validation:

• go test ./command/ca
• make test — 380 tests passed
• make lint — 0 issues
• make build — passed
• govulncheck ./... — no reachable vulnerabilities
• git diff --check — clean

💔Thank you!

[CLAassistant]

All committers have signed the CLA.