How to configure as an intermediate CA under an external root CA

[maraino]

How to configure as an intermediate CA under an external root CA

[dopey]

I believe this is documented here: https://github.com/smallstep/certificates/blob/master/docs/questions.md#i-already-have-pki-in-place-can-i-use-this-with-my-own-root-certificate.

Closing as done.

[dopey]

If I understand correctly, you already have a root certificate and an intermediate certificate that you've generated.

step-ca doesn't need to generate it's own intermediate certificate, it can use one that you've already generated. If you look in the $(step path)/config/ca.json you'll see where the root certificate and the intermediate cert/key are configured (near the top). You just need to replace those values with the ones you already have created. No need for bundling, I think. Let me know if that does/doesn't make sense.

[Johannestegner]

How is this task going? Would love to try this project out as an intermediate CA server as I don't wish to expose my root ca private key outside of its current location :)

(I will take a look at the code and see if I can figure it out, in case I do I might send a PR later) :)

[dopey]

Hey @Johannestegner, step ca does have the ability to bootstrap off an existing root certificate. But our recommendation in terms of how to do that will depend on some details about your infrastructure and security policy. (e.g. does the box with your root private key have internet access?). If you want to hop in our Gitter we'd be glad to talk through some possible solutions for your setup.

[maraino]

@Johannestegner: this issue is still in our backlog, if you have access to the root key of your certificate you can use step ca init --root=<root-crt> --key=<root-key> to initialize CA configuration. You can also sign the intermediate with step certificate create --profile intermediate-ca ....
But f you need a CSR to sign an intermediate certificate, we still don't have that support and you will need to use openssl for that.

[Johannestegner]

Hi! :)

I have Intermediate CA's set up already for a few different uses. The "box" with my root CA is a paper-key (my CA key gpg encrypted and signed) hehe, so it don't have much internet access! ;D

But it should be easy enough to use one of my Intermediate CA's right away I would guess?
If i Bundle together the Root and Intermediate CA in a pem-file (pub) and only use the intermediate key and use that instead of the root in the init step, would that work as good?

I guess I could actually just try the above... hehee, I will do that, but feel free to answer for future reference! :)

[patsevanton]

Where doc https://github.com/smallstep/certificates/blob/master/docs/questions.md#i-already-have-pki-in-place-can-i-use-this-with-my-own-root-certificate ?