---
title: Charmhub | Deploy OpenBao using Charmhub - The Open Operator Collection
description: Deploy the latest version of OpenBao on any cloud.
url: https://charmhub.io/openbao/docs/h-use-vault-as-intermediate-ca
---

# OpenBao

[Goran Stojanoski](https://charmhub.io/publisher/goranstoj "View all packages from Goran Stojanoski")

* [Goran Stojanoski](https://charmhub.io/publisher/goranstoj "View all packages from Goran Stojanoski")

Platform:

26.04

24.04

edge 4

```
juju deploy openbao --channel edge
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://canonical-openbao-charms.readthedocs-hosted.com/)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/openbao-omnicraft/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Use Vault as an intermediate CA

In this how-to guide, we will configure Vault to act as an intermediate Certificate Authority (CA) using [Vault’s PKI secrets engine](https://developer.hashicorp.com/vault/docs/secrets/pki). Here [self-signed-certificates](https://charmhub.io/self-signed-certificates) will be the parent CA and [tls-certificates-requirer](https://charmhub.io/tls-certificates-requirer) will be the charm requesting a certificate to Vault.

The certificates issued by Vault will have a validity period that is half of its intermediate CA’s, which is determined by the root provider’s configuration, in this case, the self-signed certificates.

1. Configure Vault’s common name

Vault PKI will only allow issuing certificates for the subdomains of the common\_name configured here, it will reject any requests using differnt domains in their subject.

```
juju config vault common_name=mydomain.com
```

1. Deploy the parent CA

```
juju deploy self-signed-certificates --channel 1/stable
```

1. Integrate Vault with its parent CA

```
juju integrate vault:tls-certificates-pki self-signed-certificates
```

1. Deploy `tls-certificates-requirer`

The common name must be a subdomain of the Vault common name

```
juju deploy tls-certificates-requirer --config common_name=demo.mydomain.com  --config sans_dns=demo.mydomain.com
```

1. Integrate TLS Certificates Requirer with Vault

```
juju integrate tls-certificates-requirer vault:vault-pki
```

1. Retrieve the certificate

```
juju run tls-certificates-requirer/leader get-certificate
```

---