How to move Vault into his own intermediate?

Vault
4

Hi @mouglou,

I hope you are still reading this, since I just came up with a similar idea. :joy:

  1. Setup a three-node Vault cluster with internal storage (thus circumventing the Consul setup).
  2. Generate some short-lived “bootstrap” certificates for each node using Ansible.
  3. Create Vault intermediate CA, importing the root certificate.
  4. Use consul-template to request a new certificate for each node, write them to disk and restart/SIGHUP vault.

I’m still not sure if this is “clever” or incredibly stupid. In the worst case, I still could use Ansible to replace all certificates of the Vault nodes.

2 Likes