The destructive side-effect of the get-csr action is a result of the behaviour of vault not of the charm. This is noted here https://www.vaultproject.io/api-docs/secret/pki#generate-intermediate "This will overwrite any previously existing CA private key.". It can also been seen by interacting directly with the vault api:
juju run --unit vault/0 "leader-get local-charm-access-id"
f52eeaeb-da57-088b-c3e8-0e0437a01bd6
# Generating a new certificate now fails:
ubuntu@juju-569389-20220216093413-2:~$ vault write charm-pki-local/issue/local common_name="test-0.project.serverstack" ttl="24h"
Error writing data to charm-pki-local/issue/local: Error making API request.
The destructive side-effect of the get-csr action is a result of the behaviour of vault not of the charm. This is noted here https:/ /www.vaultproje ct.io/api- docs/secret/ pki#generate- intermediate "This will overwrite any previously existing CA private key.". It can also been seen by interacting directly with the vault api:
juju run --unit vault/0 "leader-get local-charm- access- id" da57-088b- c3e8-0e0437a01b d6
f52eeaeb-
juju ssh vault/0 127.0.0. 1:8220' f52eeaeb- da57-088b- c3e8-0e0437a01b d6 | awk '/token\s/ {print $NF}')
export VAULT_ADDR='http://
export VAULT_TOKEN=$(vault write auth/approle/login role_id=
# Generating a certificate works: local/issue/ local common_ name="test- 0.project. serverstack" ttl="24h"
vault write charm-pki-
# Generating a new csr: local/intermedi ate/generate/ internal common_name="Vault Intermediate Authority" wJzElMCMGA1UEAx McVmF1bHQgSW50Z XJtZWRpYXRlIEF1 dGhv JKoZIhvcNAQEBBQ ADggEPADCCAQoCg gEBALmstpUShGX4 DalT MXQReOmv3lvqE70 XdszqqUP26KyMxv bc0WM9Qeqpa8Qqe EAcx 5YkHBRflZvypnv8 0urJMkXzaKs895a 8T0GI7xZ34RautV WxhU XMq+qv7lVZOTjNY gkGymHtjx8a4RNO SG9H4ZHFfaD/ xUeC6Sv 1dcdcKLHfVwdXYG tHJEf3kCWJ1GpVr Jy3i4RkDxg7ZVPX b2U1 jJrUwVhENiy4whh e1hFZKBEqyXdagW eMCjvToo3m5i0fh n4y0 AMA0GCSqGSIb3DQ EBCwUAA4IBAQA0I MHQ5Uz1n84bgJDO NxQ3 3iVfyOIzVSZ7sV+ liN9xn/ StlY6JfRF+ pVsXeHQlmctlrGs Zp LC2TeRF2cwawn73 M0dRcij8B5Qh18o B4RVnuoNhtJ+ hB8Iv6t cNZ0b1/ aBahgshltJFj+ bSDxkJVUapMzd9E +MermgYRJT7dC4 2M34qe9V56cFbY9 OrP0bA8Bc9c72Iw znuvJEgsOYqsjGc Z+xZy 2bWdkNt7uEGrlR8 PkFsl5sisoO3k92 AZaf1WLlHP3mkwF xN4iuT/ I3fk
vault write charm-pki-
Key Value
--- -----
csr -----BEGIN CERTIFICATE REQUEST-----
MIICbDCCAVQCAQA
cml0eTCCASIwDQY
fnopZJW3xq0Twra
N13qVCrbQb095cp
ew3ryZCcWbRIX0w
/m0NGRiXKaFX43s
ai3oM5coKBboRmU
AndwJPsCAwEAAaA
eG1kd37BAb6eDLZ
4fmuIBSRlWSDzov
Uf8TwaO1NGza2VS
au66KLrx1RYjO+
bZd0/Wa+
-----END CERTIFICATE REQUEST-----
# Generating a new certificate now fails: juju-569389- 20220216093413- 2:~$ vault write charm-pki- local/issue/ local common_ name="test- 0.project. serverstack" ttl="24h" local/issue/ local: Error making API request.
ubuntu@
Error writing data to charm-pki-
URL: PUT http:// 127.0.0. 1:8220/ v1/charm- pki-local/ issue/local
Code: 500. Errors:
* 1 error occurred:
* error fetching CA certificate: stored CA information not able to be parsed