---
title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection
description: Deploy the latest version of Vault on any cloud.
url: https://charmhub.io/vault/docs/h-use-vault-as-intermediate-ca
---

# Vault

[Vault charmers](https://charmhub.io/publisher/vault-charmers "View all packages from Vault charmers")

* [Vault charmers](https://charmhub.io/publisher/vault-charmers "View all packages from Vault charmers")
* [Security](https://charmhub.io/?filter=security)

Platform:

24.04

23.10

23.04

22.10

22.04

20.04

18.04

2.0/stable 710

```
juju deploy vault --channel 2.0/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/vault)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/vault-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Use Vault as an intermediate CA

In this how-to guide, we will configure Vault to act as an intermediate Certificate Authority (CA) using [Vault’s PKI secrets engine](https://developer.hashicorp.com/vault/docs/secrets/pki). Here [self-signed-certificates](https://charmhub.io/self-signed-certificates) will be the parent CA and [tls-certificates-requirer](https://charmhub.io/tls-certificates-requirer) will be the charm requesting a certificate to Vault.

The certificates issued by Vault will have a validity period that is half of its intermediate CA’s, which is determined by the root provider’s configuration, in this case, the self-signed certificates.

1. Configure Vault’s common name

Vault PKI will only allow issuing certificates for the subdomains of the common\_name configured here, it will reject any requests using differnt domains in their subject.

```
juju config vault common_name=mydomain.com
```

1. Deploy the parent CA

```
juju deploy self-signed-certificates --channel 1/stable
```

1. Integrate Vault with its parent CA

```
juju integrate vault:tls-certificates-pki self-signed-certificates
```

1. Deploy `tls-certificates-requirer`

The common name must be a subdomain of the Vault common name

```
juju deploy tls-certificates-requirer --config common_name=demo.mydomain.com  --config sans_dns=demo.mydomain.com
```

1. Integrate TLS Certificates Requirer with Vault

```
juju integrate tls-certificates-requirer vault:vault-pki
```

1. Retrieve the certificate

```
juju run tls-certificates-requirer/leader get-certificate
```

---