Build Certificate Authority (CA) in Vault with an offline Root : Missing --path-length

Vault
1

Hello,

I think --path-length should be set to 2 for the RootCA, otherwise the ICA1 could not generate any certificate.

Here is the related doc page: Build Certificate Authority (CA) in Vault with an offline Root | Vault - HashiCorp Learn

2

Agreed - depends on certstrap version having that flag, still seems to generate certs but verifying fails

1 Like
3

Interesting, I was going to write a post about this too when I saw this. Indeed, the path length should be explicit, otherwise certstrap will generate it with path length 1.