Set up OpenBao as an internal Certificate Authority using the PKI secrets engine. Covers the full workflow: generating a root CA, creating an intermediate CA, configuring roles, and issuing TLS certificates for services. Follows OpenBao Part 9 — Secrets Engines PKI.
Prerequisites checklist
Confirm these before running steps:
- OpenBao deployed, initialised, and unsealed
- Token with sys/mounts and pki/* permissions
- Understanding of PKI concepts (CA hierarchy, certificate chains)
1Enable the PKI secrets engine for the root CA
bao secrets enable -path=pki pki→ Success! Secrets engine enabled at: pki/
2Set the maximum TTL for the root CA (10 years)
bao secrets tune -max-lease-ttl=87600h pki→ Success! Tuned secrets engine at: pki/
This makes sense, as you do not want to rotate the root CA too often.
3Generate the root CA certificate
DOMAIN=example.combao write -field=certificate pki/root/generate/internal common_name=${DOMAIN} ttl=87600h > root-ca.crt→ Success! Certificate generated and saved to: root-ca.crt
4Configure CA and CRL URLs
bao write pki/config/urls issuing_certificates=http://openbao.openbao.svc:8200/v1/pki/ca crl_distribution_points=http://openbao.openbao.svc:8200/v1/pki/crl→ Success! CA and CRL URLs configured
5Enable the intermediate PKI engine on the path `pki_int`
Follows the same pattern as the root CA; we just change the path and the TTL.
bao secrets enable -path=pki_int pkibao secrets tune -max-lease-ttl=43800h pki_int6Generate an intermediate CSR
bao write -format=json pki_int/intermediate/generate/internal common_name=${DOMAIN} | jq -r '.data.csr' > intermediate.csr→ Success! Certificate generated and saved to: intermediate.csr
7Sign the intermediate CSR with the root CA
bao write -format=json pki/root/sign-intermediate csr=@intermediate.csr format=pem_bundle ttl=43800h | jq -r '.data.certificate' > intermediate.crt→ Success! Certificate generated and saved to: intermediate.crt
8Set the signed intermediate certificate
This will configure the system to issue certificates from the intermediate CA.
bao write pki_int/intermediate/set-signed certificate=@intermediate.crt9Create a role for issuing certificates
We will create a role that allows issuing certificates for the domain
example.com and all its subdomains.bao write pki_int/roles/example-dot-com allowed_domains=${DOMAIN} allow_subdomains=true max_ttl=720h→ Success! Role created at: pki_int/roles/example-dot-com
10Issue a certificate using the role
bao write pki_int/issue/example-dot-com common_name=myapp.example.com ttl=24h→ Success! Certificate generated and the full chain is returned.
→ Returns certificate for myapp.example.com and its key