Ah, I see, thanks for flagging this @Malshtur and @luke.stephenson – this seems to be an error in the tutorial headings.
The tutorial step 8 describes creating a root bridge certificate – an “intermediate” (in technicality only) that is useful for bridging between two separate roots of trust. E.g., if you had devices with root-2023 hard-coded and not replaceable, this bridge CA would let you validate against it, in a slightly different way than cross-signing would.
Sometimes this is useful for injecting a new root CA into a hierarchy (temporarily) to separate PKIs. E.g., if everything chained up through a common widely-trusted root CA but now we wish to separate CAs, a temporary bridge CA can be used here to allow people still trusting the old root (but not yet moving to the separate PKI) to access this.
I’ll follow up with the tutorials team, thank you!
I think perhaps an alternative (correct under this header name) would be:
- Get a CSR to cross-sign the intermediate
$ vault write -format=json pki_int/intermediate/cross-sign \
common_name="example.com Intermediate Authority" \
key_ref="$(vault read pki_int/issuer/example-dot-com-intermediate \
| grep -i key_id | awk '{print $2}')" \
| jq -r '.data.csr' \
| tee cross-signed-intermediate.csr
- Sign the CSR under the new root.
$ vault write -format=json pki/issuer/root-2024/sign-intermediate \
common_name="example.com Intermediate Authority" \
csr=@cross-signed-intermediate.csr \
| jq -r '.data.certificate' | tee cross-signed-intermediate.crt
- Import the cross-signed certificate into the new mount.
$ vault write pki_int/intermediate/set-signed \
certificate=@cross-signed-intermediate.crt
$ vault write pki_int/issuer/<uuid> issuer_name=xc-example-dot-com-intermediate
- When reading issuers, the CA chain will not change:
$ vault read pki_int/issuer/example-dot-com-intermediate
$ vault read pki_int/issuer/xc-example-dot-com-intermediate
- But if it is desired to update them to refer to each other on sign requests, use
manual_chain:
$ vault patch pki_int/issuer/example-dot-com-intermediate manual_chain=self,xc-example-dot-com-intermediate
$ vault patch pki_int/issuer/xc-example-dot-com-intermediate manual_chain=self,example-dot-com-intermediate
and then they would update their chains and do what we’d expect. This is since they are sibling CAs, not in a hierarchy, so automated chain building does not detect them.
.
