50 lines
1.5 KiB
Bash
50 lines
1.5 KiB
Bash
# Enable the PKI secrets engine for the root CA and for the issuing CA
|
|
vault secrets enable pki
|
|
vault secrets enable -path=pki_int pki
|
|
|
|
# Set the maximum TTLs of the CAs
|
|
vault secrets tune -max-lease-ttl=87600h pki
|
|
vault secrets tune -max-lease-ttl=43800h pki_int
|
|
|
|
# Generate the root CA inside Vault
|
|
vault write pki/root/generate/internal \
|
|
common_name="Test CA" \
|
|
issuer_name=root \
|
|
key_type=rsa \
|
|
key_bits=4096 \
|
|
ttl=87600h \
|
|
max_path_length=1
|
|
|
|
# Generate the issuing CA key and CSR
|
|
vault write -field=csr pki_int/intermediate/generate/internal \
|
|
common_name="Issuing Test CA" \
|
|
key_type=rsa \
|
|
key_bits=4096 > issuing_ca.csr
|
|
|
|
# Sign the issuing CA CSR with the root CA
|
|
vault write -field=certificate pki/root/sign-intermediate \
|
|
csr=@issuing_ca.csr \
|
|
format=pem_bundle \
|
|
ttl=43800h \
|
|
max_path_length=0 > issuing_ca_signed.pem
|
|
|
|
# Install the signed issuing CA certificate
|
|
vault write pki_int/intermediate/set-signed certificate=@issuing_ca_signed.pem
|
|
|
|
# Create a role that issues client authentication certificates
|
|
vault write pki_int/roles/wif-client \
|
|
allow_any_name=true \
|
|
enforce_hostnames=false \
|
|
server_flag=false \
|
|
client_flag=true \
|
|
key_type=rsa \
|
|
key_bits=4096 \
|
|
key_usage=DigitalSignature,KeyEncipherment \
|
|
ttl=8760h \
|
|
max_ttl=8760h \
|
|
no_store=true
|
|
|
|
# Export the CA certificates
|
|
vault read -field=certificate pki/cert/ca > ca_cert.pem
|
|
vault read -field=certificate pki_int/cert/ca > issuing_ca_cert.pem
|