Is it possible to associate an intermediate CA to a provisioner?

[BHuck74]

Dear all,

One step ahead in using step-ca and something giving me some headache.

My PKI is made of root CA plus one intermediate CA used to sign all my certificates. I created 2 provisioners associated with templates so I can create cert for servers or clients. All that stuff is now automated using Ansible and working fine.

Now I need to renew my certificates for Bacula, and normally I should create a new intermediate certificate used to sign those certificates. That’s fine but I would like to use a new provisionner I could invoke for that purpose. The problem is I did not find how to associated the new intermediate certificates to the new provisioner. By default, the newly created provisioner uses the former intermediate cert. Perhaps I’m doing something wrong, but shouldn’t be possible to set up that stuff for the new provisioner to use the new intermediate CA? I cant’t do it through configuration files because I installed step-ca along with mysql. I’m really stuck at that point…

[hslatman]

Hey @BHuck74,

step-ca is designed to use a single certificate chain. If you need a separate signing chain, chaining to your existing root, then you'll have to create a new intermediate signed by that root, and run an additional instance of step-ca. You can find how to do such a setup at https://smallstep.com/docs/tutorials/intermediate-ca-new-ca/. In this case your existing CA is step-ca (generally it's a different solution).

[BHuck74]

Thank you very much @hslatman for your time and this answer.

Looks quite complicated for what it desserves. But why couldn't I simply use another intermediate CA that would be used to sign my client certs? Maybe a stupid question, but I'm not an expert...

[hslatman]

Not sure I fully understand this question. It is possible to do, but with step-ca you can only have one intermediate CA active in a single step-ca instance at a time, because that's how it's implemented in our software. It could've been different, but this implementation decision was made at some point, and we never added support for multiple signing chains to be active at the same time.

But maybe this is more of an XY problem: why do you (think you) need a new intermediate CA in the first place? If you initialized the CA with its default settings you should have a PKI with a 10 year root and intermediate. You should be able to renew your leaf certificates using the existing intermediate certificate. Or does Bacula require something specific to be set in the signing chain?

[BHuck74]

Ok I better understand this architecture now... You are totally right and I'm probably overthinking. Using the existing intermediate CA, and just creating a new provisioner to generate Bacula certs will probably be the best option. Bacula just need an additional CA type certificate that you can use to decrypt the backup in case you are no more able to use the regular client certs. I may probably create a standalone cert just for that purpose.

Again, thank you for your time and patience, my learning curve is increasing 😂