Moving PKI certs from one instance to another

Vault
1

I’m helping a non-profit move their PKI infrastructure from one vault instance to another and running into some issues.

I setup terraform to basically mimic the old setup. pki-root-ca and pki-int-ca have been mounted and configured exactly the same but when I try to import the existing certs and keys I’m doing something wrong.

old instance: 127.0.0.1:8300 – 1.8.0
new instance: 127.0.0.1:8200 – 1.8.2

I have all of the crt and certs and keys, they have issued 56 certs from their int. I would rather not have to replace whatever is in the field.

# vault write pki-root-ca/config/ca pem_bundle="@ca_cert_key_bundle.pem"
Success! Data written to: pki-root-ca/config/ca
# vault write pki-root-ca/config/urls issuing-certificates="https://10.1.1.2/v1/pki-root-ca/ca" crl_distribution_points="https://10.1.1.2/v1/pki-root-ca/crl"
# curl -s http://127.0.0.1:8200/v1/pki-root-ca/ca/pem
-----BEGIN CERTIFICATE-----
MIIGGzCCBAOgAwIBAgIR....

However, the CA cert doesn’t show up in the pki-root-ca on the console. It’s empty.

Also, I can’t seem to import the pki_int cert:

# vault write pki-int-ca/intermediate/set-signed certificate=@int_cert.crt
Error writing data to pki-int-ca/intermediate/set-signed: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/pki-int-ca/intermediate/set-signed
Code: 400. Errors:

* no data found in PEM block
# vault write pki-int-ca/intermediate/set-signed certificate=@int_cert.pem
Error writing data to pki-int-ca/intermediate/set-signed: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/pki-int-ca/intermediate/set-signed
Code: 400. Errors:

* could not find any existing entry with a private key