Hashicorp Vault PKI as a "frontend" to step-ca

[rommanio]

Could it be possible?

    What information would you like stored in Vault? It sounds like you want `step-ca` to issue certificates... are you wanting to use Vault's authentication mechanisms to get a certificate from `step-ca`? So when you request a certificate from Vault it's actually issued by `step-ca`?

Originally posted by @mmalone in #138 (comment)

[hslatman]

@rommanio: Do you want to put Vault in front of step-ca? Or do you want step-ca in front of Vault? The title seems to be about the first, but the comment comes from a thread that seems to be more about the latter.

A case can be made for both. With step-ca in front of Vault, the Vault PKI engine can be used to sign certificates. This is already possible with the Vault RA Mode described here: https://smallstep.com/docs/step-ca/registration-authority-ra-mode/#hashicorp-vault-ra-mode.

Putting Vault directly in front of step-ca is currently not possible. One way to support this is through a custom Secrets Engine for Vault that uses the step-ca API client to sign certificates.

[nsmith5]

@rommanio using Vault authentication to get a certificate from step-ca is pretty straightforward actually. You just use the OIDC Identity provider to exchange your Vault creds for a step-ca cert. I've done this to use the simple username -password auth engine for Vault to grab certificates from step-ca.

In principal you can bake what ever information you want into the claims of the OIDC token you want in Vault so you could pass those through to step to template into your certificate, but the docs are a little shakey on the Vault side of that stuff so I never got that far.