Page MenuHomeDevCentral
Files F11697524

D3657.id9473.diff
No OneTemporary
Actions

D3657.id9473.diff
View Options

diff --git a/roles/vault/bootstrap/files/vault-initialize.sh b/roles/vault/bootstrap/files/vault-initialize.sh
--- a/roles/vault/bootstrap/files/vault-initialize.sh
+++ b/roles/vault/bootstrap/files/vault-initialize.sh
@@ -47,19 +47,20 @@
CA_ROOT_NAME=root
CA_ROOT_PATH=$PREFIX_PKI$CA_ROOT_NAME
+ROOT_ISSUER_REF=$(date "+root-%Y")
vault secrets enable -path=$CA_ROOT_PATH pki
vault secrets tune -max-lease-ttl=87600h
vault write -field=certificate $CA_ROOT_PATH/root/generate/internal \
common_name=$DOMAIN \
+ issuer_name="$ROOT_ISSUER_REF" \
ttl=87600h > $CERTS_PATH/nasqueron-vault-ca.crt
vault write $CA_ROOT_PATH/config/urls \
issuing_certificates="$PUBLIC_URL/$CA_ROOT_NAME/ca" \
crl_distribution_points="$PUBLIC_URL/$CA_ROOT_NAME/crl"
-
# -------------------------------------------------------------
# PKI :: intermediate CA for Vault own certificates
#
@@ -75,20 +76,25 @@
CSR=$(mktemp /tmp/csr.XXXX)
vault write -format=json $CA_VAULT_PATH/intermediate/generate/internal \
common_name="$DOMAIN Intermediate Authority" \
+ issuer_name="drake-nasqueron-intermediate" \
| jq -r '.data.csr' > "$CSR"
+
vault write -format=json $CA_ROOT_PATH/root/sign-intermediate csr=@"$CSR" \
- format=pem_bundle ttl="2160h" \
+ issuer_ref="$ROOT_ISSUER_REF" \
+ format=pem_bundle ttl="8760h" \
| jq -r '.data.certificate' > $CERTS_PATH/nasqueron-vault-intermediate.crt
rm "$CSR"
-vault write $CA_VAULT_PATH/intermediate/set-signed \
- certificate=@$CERTS_PATH/nasqueron-vault-intermediate.crt
+ISSUER=$(vault write -format=json $CA_VAULT_PATH/intermediate/set-signed \
+ certificate=@$CERTS_PATH/nasqueron-vault-intermediate.crt \
+ | jq -r '.data.imported_issuers[0]')
vault write $CA_VAULT_PATH/config/urls \
issuing_certificates="$PUBLIC_URL/$CA_VAULT_NAME/ca" \
crl_distribution_points="$PUBLIC_URL/$CA_VAULT_NAME/crl"
vault write $CA_VAULT_PATH/roles/nasqueron-drake \
+ issuer_ref="$ISSUER" \
allowed_domains="nasqueron.drake" \
allow_subdomains=true \
max_ttl="2160h"
diff --git a/utils/vault/pki-intermediate-regenerate.sh b/utils/vault/pki-intermediate-regenerate.sh
new file mode 100755
--- /dev/null
+++ b/utils/vault/pki-intermediate-regenerate.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+
+set -e
+
+export VAULT_SKIP_VERIFY=1
+
+PKI_ROOT=pki_root
+PKI_INTERMEDIATE=pki_vault
+WORKDIR=$(mktemp -d -t vault-intermediate)
+
+cd $WORKDIR
+
+vault write -format=json $PKI_INTERMEDIATE/intermediate/generate/internal \
+ common_name="nasqueron.drake Intermediate Authority" \
+ issuer_name="drake-nasqueron-intermediate" \
+ | jq -r '.data.csr' > cert_intermediate.csr
+
+vault write -format=json $PKI_ROOT/root/sign-intermediate \
+ issuer_ref="root-2022" \
+ csr=@cert_intermediate.csr \
+ format=pem_bundle ttl="8760h" \
+ | jq -r '.data.certificate' > cert_intermediate.pem
+
+ISSUER=$(vault write -format=json $PKI_INTERMEDIATE/intermediate/set-signed \
+ certificate=@cert_intermediate.pem \
+ | jq -r '.data.imported_issuers[0]')
+
+vault write $PKI_INTERMEDIATE/roles/nasqueron-drake \
+ issuer_ref="$ISSUER" \
+ allowed_domains="nasqueron.drake" \
+ allow_subdomains=true \
+ max_ttl="2160h"
+
+cd /tmp
+rm $WORKDIR/cert*
+rmdir $WORKDIR

File Metadata

Mime Type
text/plain
Expires
Fri, Sep 12, 15:27 (16 h, 55 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2979575
Default Alt Text
D3657.id9473.diff (3 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator