Skip to content

Latest commit

 

History

History
64 lines (44 loc) · 1.51 KB

Vault_CA.md

File metadata and controls

64 lines (44 loc) · 1.51 KB
Raw

Configure Vault as a Certificate Authority

This can be done in two ways:

1. Vault generated CA.

  • Mount the PKI backend with this command:

    vault mount pki

  • Now we set maximum life time for the certificate:

    vault mount-tune -max-lease-ttl=87600h pki

  • We generate our root certificate:

    vault write pki/root/generate/internal common_name=myvault.com ttl=87600h

  • Configure a role:

    vault write pki/roles/example-role allow_any_name="true" \
allow_subdomains="true" allow_ip_sans="true" max_ttl="72h" \
allow_localhost="true" allow_ip_sans="true"

WARNING: When running Vault in "Dev" Server Mode, Vault shutdown will result in CA being deleted.

2. Externally generated CA.

  • Mount the PKI backend with this command:

    vault mount pki

  • Now we need to create a certificate bundle. (For basic configuration of CA via openssl follow this guide).

    export CA_PATH=/PATH/TO/CA
cat $CA_PATH/ca.cert.pem > /path/to/vault/ca_bundle.pem
openssl rsa -in $CA_PATH/private/ca.key >> /path/to/vault/ca_bundle.pem

  • Assign CA to vault:

    vault write pki/config/ca pem_bundle="@/path/to/vault/ca_bundle.pem"

  • Configure a role:

    vault write pki/roles/example-role allow_any_name="true" \
allow_subdomains="true" allow_ip_sans="true" max_ttl="72h" \
allow_localhost="true" allow_ip_sans="true"