Automating Intermediate CA Generation in Bank-Vaults

[frnode]

Automating Intermediate CA Generation in Bank-Vaults

Overview

Is it possible to automate the generation of an Intermediate Certificate Authority (CA) using bank-vaults on AKS (Kubernetes) ? The goal is to integrate this process into the existing configuration.

Current Setup

A Root Certificate Authority (CA) has been successfully deployed with the following configuration:

externalConfig:
  secrets:
    - type: pki
      path: pki
      description: Vault PKI Root Backend
      config:
        default_lease_ttl: 87600h
        max_lease_ttl: 87600h
      configuration:
        config:
          - name: urls
            issuing_certificates: "xxx/v1/pki/ca"
            crl_distribution_points: "xxx/v1/pki/crl"
            ocsp_servers: "xxx/v1/pki/ocsp"
        root/generate:
          - name: internal
            common_name: XXX - Root CA
            ttl: 87600h
            key_type: rsa
            key_bits: 4096

Current Status

The Root CA is operational and issues certificates. The next step is to automate Intermediate CA generation and signing by the Root CA.

Challenges

• Automation: Automating Intermediate CA creation within externalConfig.
• Integration: Aligning with the current setup.
• Future-proofing: Supporting offline Root CA scenarios (e.g., Azure Key Vault).

Expected Outcome

Confirmation or guidance on whether:

• Intermediate CA generation can be automated.
• The process integrates into the existing deployment.

Additional Context

• Environment: Azure Kubernetes Service (AKS).
• Root CA Status: Fully operational.
• Future Plans: Possible offline Root CA hosting in Azure Key Vault.

Thank you for your insights or documentation!

[medarion]

Not sure if it's of any help to you, but I tried it a few months back and came to the conclusion that it's currently not possible. The reason is, that after writing to pki_int/intermediate/generate/internal, you need to provide the resulting certificate signing request to pki/root/sign-intermediate to have it signed by the root CA. But at the moment there seems to be no way to reference an external file with externalConfig the way it's done in the Vault example using the Vault CLI.