---
title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection
description: Deploy the latest version of Vault as a Kubernetes Operator on any cloud.
url: https://charmhub.io/vault-k8s/docs/h-use-vault-as-intermediate-ca
---

# Vault

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

2.0/stable 565

```
juju deploy vault-k8s --channel 2.0/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/vault-k8s)

---

#### Contacts

##### Maintainers

+ [Matrix Channel](https://matrix.to/#/!yAkGlrYcBFYzYRvOlQ:ubuntu.com?via=ubuntu.com&via=matrix.org&via=mozilla.org)

* [Submit a bug](https://github.com/canonical/vault-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Use Vault as an intermediate CA

In this how-to guide, we will configure Vault to act as an intermediate Certificate Authority (CA) using [Vault’s PKI secrets engine](https://developer.hashicorp.com/vault/docs/secrets/pki). Here [self-signed-certificates](https://charmhub.io/self-signed-certificates) will be the parent CA and [tls-certificates-requirer](https://charmhub.io/tls-certificates-requirer) will be the charm requesting a certificate to Vault.

The certificates issued by Vault will have a validity period that is half of its intermediate CA’s, which is determined by the root provider’s configuration, in this case, the self-signed certificates.

1. Configure Vault’s common name

Vault PKI will only allow issuing certificates for the subdomains of the common\_name configured here, it will reject any requests using differnt domains in their subject.

```
juju config vault common_name=mydomain.com
```

1. Deploy the parent CA

```
juju deploy self-signed-certificates --channel 1/stable
```

1. Integrate Vault with its parent CA

```
juju integrate vault:tls-certificates-pki self-signed-certificates
```

1. Deploy `tls-certificates-requirer`

The common name must be a subdomain of the Vault common name

```
juju deploy tls-certificates-requirer --config common_name=demo.mydomain.com  --config sans_dns=demo.mydomain.com
```

1. Integrate TLS Certificates Requirer with Vault

```
juju integrate tls-certificates-requirer vault:vault-pki
```

1. Retrieve the certificate

```
juju run tls-certificates-requirer/leader get-certificate
```

---