Step-CA doesn't work with server alternative names (SAN)
Solution 1:
The example given by the Step-CA help text is all wrong. To solve this issue, use the main name as the subject. E.g.:
step ca certificate --san dtk --san dtk.intranet.local dtk.intranet.local /root/dtk.crt /root/dtk.key