# Enable the PKI secrets engine for the root CA and for the issuing CA
vault secrets enable pki
vault secrets enable -path=pki_int pki

# Set the maximum TTLs of the CAs
vault secrets tune -max-lease-ttl=87600h pki
vault secrets tune -max-lease-ttl=43800h pki_int

# Generate the root CA inside Vault
vault write pki/root/generate/internal \
    common_name="Test CA" \
    issuer_name=root \
    key_type=rsa \
    key_bits=4096 \
    ttl=87600h \
    max_path_length=1

# Generate the issuing CA key and CSR
vault write -field=csr pki_int/intermediate/generate/internal \
    common_name="Issuing Test CA" \
    key_type=rsa \
    key_bits=4096 > issuing_ca.csr

# Sign the issuing CA CSR with the root CA
vault write -field=certificate pki/root/sign-intermediate \
    csr=@issuing_ca.csr \
    format=pem_bundle \
    ttl=43800h \
    max_path_length=0 > issuing_ca_signed.pem

# Install the signed issuing CA certificate
vault write pki_int/intermediate/set-signed certificate=@issuing_ca_signed.pem

# Create a role that issues client authentication certificates
vault write pki_int/roles/wif-client \
    allow_any_name=true \
    enforce_hostnames=false \
    server_flag=false \
    client_flag=true \
    key_type=rsa \
    key_bits=4096 \
    key_usage=DigitalSignature,KeyEncipherment \
    ttl=8760h \
    max_ttl=8760h \
    no_store=true

# Create a role that issues server authentication certificates
vault write pki_int/roles/web-server \
    allow_any_name=true \
    enforce_hostnames=true \
    server_flag=true \
    client_flag=false \
    key_type=rsa \
    key_bits=4096 \
    key_usage=DigitalSignature,KeyEncipherment \
    ttl=8760h \
    max_ttl=8760h \
    no_store=true

# Export the CA certificates
vault read -field=certificate pki/cert/ca > ca_cert.pem
vault read -field=certificate pki_int/cert/ca > issuing_ca_cert.pem