Automating Intermediate CA Generation in Bank-Vaults

[frnode]

Automating Intermediate CA Generation in Bank-Vaults

Overview

Is it possible to automate the generation of an Intermediate Certificate Authority (CA) using bank-vaults on AKS (Kubernetes) ? The goal is to integrate this process into the existing configuration.

Current Setup

A Root Certificate Authority (CA) has been successfully deployed with the following configuration:

externalConfig:
  secrets:
    - type: pki
      path: pki
      description: Vault PKI Root Backend
      config:
        default_lease_ttl: 87600h
        max_lease_ttl: 87600h
      configuration:
        config:
          - name: urls
            issuing_certificates: "xxx/v1/pki/ca"
            crl_distribution_points: "xxx/v1/pki/crl"
            ocsp_servers: "xxx/v1/pki/ocsp"
        root/generate:
          - name: internal
            common_name: XXX - Root CA
            ttl: 87600h
            key_type: rsa
            key_bits: 4096

Current Status

The Root CA is operational and issues certificates. The next step is to automate Intermediate CA generation and signing by the Root CA.

Challenges

• Automation: Automating Intermediate CA creation within externalConfig.
• Integration: Aligning with the current setup.
• Future-proofing: Supporting offline Root CA scenarios (e.g., Azure Key Vault).

Expected Outcome

Confirmation or guidance on whether:

• Intermediate CA generation can be automated.
• The process integrates into the existing deployment.

Additional Context

• Environment: Azure Kubernetes Service (AKS).
• Root CA Status: Fully operational.
• Future Plans: Possible offline Root CA hosting in Azure Key Vault.

Thank you for your insights or documentation!