How To
Summary
In HCP Vault Dedicated's PKI Secrets Engine, certificates are generated based on a Role. By default, most roles are configured to issue "End-Entity" certificates (leaf certificates). These have a Basic Constraint of CA: FALSE.
To satisfy network-layer validation, you must update the Role to allow Is CA status. This tells Vault to flip the boolean bit in the X.509 metadata so that any certificate generated under that role is recognized by the network as a functional Certificate Authority.
Objective
Demonstrate how to use the HCP Portal UI to modify PKI Role settings in the HCP Vault Dedicated PKI Secrets Engine, ensuring issued certificates include the required CA: TRUE Basic Constraints extension for compatibility with network appliances and VPN gateways.
Environment
Product/Service: HCP Vault Dedicated PKI Secrets Engine
Platform/Interface: HCP Portal UI
Target Systems: Network appliances, VPN gateways, or 802.1X authenticators
Steps
The steps taken to generate the Intermediate CA are:
- Access the Issuers tab from the pki secret engine.
- Select Generate and intermediate CSR.
- Select type exported.
- Enter the common name.
- Select format pem_bundle.
- Click Generate.
- Copy the private key to a file.
- Copy the CSR.
- Click Done.
- Go into the Root CA in your issuers.
- Click Sign Intermediate.
- Paste the CSR (make sure to remove the private key from the top of the text).
- Enter the common name.
- Set the TTL.
- Select format pem_bundle.
- Click Save.
- Note: This process allows you to generate a certificate with the necessary SSL parameters to be imported into the network appliance as its Local CA Certificate.
Additional Information
When validating the basic issued certificate with openssl, the X509v3 Basic Constraints extension shows CA:FALSE.
If these steps are not followed, an attempt to issue an intermediate certificate for an application CSR can result in the following error: 1 error occurred: * could not fetch the CA certificate (was one set?): unable to fetch corresponding key for issuer xxxx-xxxxx-xxxxx; unable to use this issuer for signing.
Related Information
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
30 March 2026
UID
ibm17267639