CODEWITHSUNDEEP
terraformhashicorp-vault
Richard
Richard

Reputation: 83

Error writing data to pki/issue/vault-server: common name not allowed by this role

When migrating the vault fqdn from vault.**.**.**.abc.com to vault.**.**.**.def.com. Hit this error. Already created the CNAME in route53 and the domain can be resolved.


URL: PUT https://ap-ops-vault.***.com/v1/pki/issue/vault-server
Code: 400. Errors:

 * common name vault.**.**.**.def.com not allowed by this role```

Upvotes: 4

Views: 5518

Answers (1)

lxop
lxop

Reputation: 8595

Without seeing your Vault role configuration, I would guess that you have the allowed_domains field set, with abc.com included but not def.com. You will need to update the role to allow names from the new domain.

Probably something like this in Terraform:

resource "vault_pki_secret_backend_role" "role" {
  backend = "${vault_pki_secret_backend.pki.path}"
  name    = "my_role"
  ...
  allowed_domains = ["abc.com", "def.com"]
  allow_subdomains = true
  ...
}

Docs:

Upvotes: 4

Related Questions