Use OpenBao as an ACME Server to obtain TLS certificates

In this how-to guide, we will configure OpenBao to act as an ACME server using OpenBao’s PKI secrets engine. Here self-signed-certificates will be the parent CA.

The certificates issued by OpenBao will have a validity period that is half of its intermediate CA’s, which is determined by the root provider’s configuration, in this case, the self-signed certificates.

Note

OpenBao ACME will allow issuing certificates depending on how it is configured, please see acme_allow_subdomains, acme_allowed_domains, acme_allow_any_name and acme_allow_wildcard_certificates

1. Configure OpenBao’s common name, and the ACME server to allow issuing certificates for subdomains and any domain name

   juju config openbao acme_ca_common_name=<your domain name> acme_allow_subdomains=true acme_allow_any_name=true
   

2. Deploy the parent CA

   juju deploy self-signed-certificates --channel 1/stable
   

3. Integrate OpenBao with its parent CA

   juju relate openbao:tls-certificates-acme self-signed-certificates
   

Now the ACME server is accessible on https://<OpenBao Address>:8200/v1/charm-acme/acme/directory

Now you should be able to obtain a certificate from OpenBao using an ACME client, for example Lego.