mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-22 23:21:08 +02:00
0660ea6fac
* Update README Let contributors know that docs will now be located in UDR * Add comments to each mdx doc Comment has been added to all mdx docs that are not partials * chore: added changelog changelog check failure * wip: removed changelog * Fix content errors * Doc spacing * Update website/content/docs/deploy/kubernetes/vso/helm.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> --------- Co-authored-by: jonathanfrappier <92055993+jonathanfrappier@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
92 lines
4.3 KiB
Plaintext
92 lines
4.3 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: pki reissue - Command
|
|
description: |-
|
|
The "pki reissue" command issues a new intermediate ("issuer") certificate,
|
|
using an existing certificate in vault as a template, and using a parent
|
|
certificate in vault to issue the new certificate.
|
|
---
|
|
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.
|
|
|
|
# pki reissue
|
|
|
|
Frequently, a reissued CA certificate is to be very similar to another.
|
|
This command enables reissuing a CA, using an existing issuer within
|
|
Vault as a template, but allowing modifications to the desired attributes.
|
|
|
|
## Usage
|
|
|
|
Usage: `vault pki reissue [flags] <parent> <template> <child_mount> [options]`
|
|
|
|
- `[flags]` are optional arguments described below.
|
|
|
|
- `<parent>` is the fully qualified path of the Certificate Authority in vault
|
|
which will issue the new intermediate certificate.
|
|
|
|
- `<template>` is the fully qualified path of an intermediate certificate in vault
|
|
which will be used to populate certificate fields not overridden by `[options]`.
|
|
|
|
~> **Note**: not all possible certificate fields are supported by Vault, and
|
|
this template reader covers only those vault generates as a best effort. If
|
|
unknown fields are set, such as when an external CA was imported into Vault,
|
|
there may not be a warning that those are missing from the new issuer.
|
|
|
|
- `<child_mount>` is the path of the mount in vault where the new issuer is saved.
|
|
|
|
- `[options]` are the superset of the k=v options passed to generate/intermediate
|
|
and sign-intermediate commands. See [below](/vault/docs/commands/pki/reissue#options).
|
|
|
|
The output of this command when it is successful is to read the resulting new
|
|
issuer entry.
|
|
|
|
### Flags
|
|
|
|
- `-type` `(string: "internal")` - This determines the type of key use for the
|
|
newly created certificate. Valid types are `"existing"` - where we link to
|
|
a key already present in the vault-backend to be used - `"internal"` - to
|
|
generate a new key for this certificate - or `"kms"` - to link to an external
|
|
key. Exported keys are not available through this API.
|
|
|
|
~> **Note**: It is only possible to generate a new certificate with an existing
|
|
key that exists in the same mount where that key-material exists. This
|
|
command is expected to fail should the template exist on a different mount,
|
|
`existing` is the selected type, and no `key_ref` for a key in the new issuer
|
|
mount is provided.
|
|
|
|
- `-issuer_name` `(string: "")` - If present, the newly created issuer will be
|
|
given this name.
|
|
|
|
### Options
|
|
|
|
Other than `type` (which is passed as a flag, see above), this command accepts
|
|
all options provided to the
|
|
[Generate CSR](/vault/api-docs/secret/pki#generate-intermediate-csr) and
|
|
[Sign Intermediate](/vault/api-docs/secret/pki#sign-intermediate) endpoints.
|
|
|
|
### Accessed APIs
|
|
|
|
Note that the vault user running this command will need to have access to the
|
|
following API endpoints, each representing a step in the process:
|
|
|
|
- `READ /:parent` - used to check validity
|
|
- `READ /:template` - used to generate the options for the new certificate
|
|
- `WRITE /:child_mount/intermediate/generate/:type` - used to generate the csr
|
|
- `WRITE /:parent/sign-intermediate` - used to sign the csr
|
|
- `WRITE /:child_mount/issuers/import/cert` - used to import the new issuer,
|
|
and the issuer chain
|
|
- `UPDATE /:child_mount/issuer/:issuer_refs` - used to both name the new
|
|
issuer, and also set the name of the parent in the issuer chain
|
|
- `READ /:child_mount/issuer/:new_issuer_ref` - used to verify completion,
|
|
generate the output
|
|
|
|
## Examples
|
|
|
|
```shell-session
|
|
$ vault pki reissue -issuer_name="SecondDepartment" /pki_root/issuer/default /pki_int/issuer/FirstDepartment /pki_int_2/ common_name="second-department.example.com"
|
|
Key Value
|
|
--- -----
|
|
ca_chain [-----BEGIN CERTIFICATE-----
|
|
MIID0DCCArigAwIBAgIUdfRe05B5eRXsg3pvsJ/g94eYuWkwDQYJKoZIhvcNAQEL```
|