slawek
db8a3aac8a
Documents issuing both client and server certificates. WIF relies on client certificates. Server example documents an example of internal Web service using an autorenewing internal certificate.
63 lines
1.8 KiB
Bash
63 lines
1.8 KiB
Bash
# Enable the PKI secrets engine for the root CA and for the issuing CA
|
|
vault secrets enable pki
|
|
vault secrets enable -path=pki_int pki
|
|
|
|
# Set the maximum TTLs of the CAs
|
|
vault secrets tune -max-lease-ttl=87600h pki
|
|
vault secrets tune -max-lease-ttl=43800h pki_int
|
|
|
|
# Generate the root CA inside Vault
|
|
vault write pki/root/generate/internal \
|
|
common_name="Test CA" \
|
|
issuer_name=root \
|
|
key_type=rsa \
|
|
key_bits=4096 \
|
|
ttl=87600h \
|
|
max_path_length=1
|
|
|
|
# Generate the issuing CA key and CSR
|
|
vault write -field=csr pki_int/intermediate/generate/internal \
|
|
common_name="Issuing Test CA" \
|
|
key_type=rsa \
|
|
key_bits=4096 > issuing_ca.csr
|
|
|
|
# Sign the issuing CA CSR with the root CA
|
|
vault write -field=certificate pki/root/sign-intermediate \
|
|
csr=@issuing_ca.csr \
|
|
format=pem_bundle \
|
|
ttl=43800h \
|
|
max_path_length=0 > issuing_ca_signed.pem
|
|
|
|
# Install the signed issuing CA certificate
|
|
vault write pki_int/intermediate/set-signed certificate=@issuing_ca_signed.pem
|
|
|
|
# Create a role that issues client authentication certificates
|
|
vault write pki_int/roles/wif-client \
|
|
allow_any_name=true \
|
|
enforce_hostnames=false \
|
|
server_flag=false \
|
|
client_flag=true \
|
|
key_type=rsa \
|
|
key_bits=4096 \
|
|
key_usage=DigitalSignature,KeyEncipherment \
|
|
ttl=8760h \
|
|
max_ttl=8760h \
|
|
no_store=true
|
|
|
|
# Create a role that issues server authentication certificates
|
|
vault write pki_int/roles/web-server \
|
|
allow_any_name=true \
|
|
enforce_hostnames=true \
|
|
server_flag=true \
|
|
client_flag=false \
|
|
key_type=rsa \
|
|
key_bits=4096 \
|
|
key_usage=DigitalSignature,KeyEncipherment \
|
|
ttl=8760h \
|
|
max_ttl=8760h \
|
|
no_store=true
|
|
|
|
# Export the CA certificates
|
|
vault read -field=certificate pki/cert/ca > ca_cert.pem
|
|
vault read -field=certificate pki_int/cert/ca > issuing_ca_cert.pem
|