Hi,
I am new to HashiCorp Vault v.1.17.5 ->PKI and currently performing a POC for issuing Certs.
I am able to invoke POST /v1/:/issue/ and I obtain a cert with its chain & Private key.
However, the Private Key needs to remain on the issuer’s side and never be shared, hence thinking of using:
POST /v1/:/sign/ with payload :
“csr”:“-----BEGIN CERTIFICATE REQUEST-----
…
-----END CERTIFICATE REQUEST-----”,
“common_name”: “example.com” .
This throws 403 Forbidden & “errors”: [ “permission denied”]
My policy contains:
path “/" {
capabilities = [ “create”, “read”, “update”, “list” ]
}
path "/sign/” {
capabilities = [“create”, “update”]
}
path “/certs/” {
capabilities = [“list”]
}
I have come across Can't configure policy for signing certificates · Issue #4347 · hashicorp/vault · GitHub & tried the workaround, to no avail (I have even tried calling the sign API with a Root token).
Any tip/workaround/fix would be highly appreciated.
Thanks,
Regards,