{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/847","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/847/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/847/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/847/events","html_url":"https://github.com/hashicorp/vault/issues/847","id":121930447,"number":847,"title":"PKI not setting 'extendedKeyUsage = serverAuth' when 'server_flag=true'","user":{"login":"ericchapman","id":317477,"avatar_url":"https://avatars.githubusercontent.com/u/317477?v=3","gravatar_id":"","url":"https://api.github.com/users/ericchapman","html_url":"https://github.com/ericchapman","followers_url":"https://api.github.com/users/ericchapman/followers","following_url":"https://api.github.com/users/ericchapman/following{/other_user}","gists_url":"https://api.github.com/users/ericchapman/gists{/gist_id}","starred_url":"https://api.github.com/users/ericchapman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericchapman/subscriptions","organizations_url":"https://api.github.com/users/ericchapman/orgs","repos_url":"https://api.github.com/users/ericchapman/repos","events_url":"https://api.github.com/users/ericchapman/events{/privacy}","received_events_url":"https://api.github.com/users/ericchapman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-13T16:52:33Z","updated_at":"2015-12-13T16:52:33Z","closed_at":null,"body":"Hi Vault Team,\r\n\r\nI am using Vault's PKI to sign certificates for my system and noticed that my generated certificates do not allow me to access Consul BUT I know my certificate is valid because it allows me to access Vault.  Here is my setup.\r\n\r\n  - I followed this tutorial to create a CA and intermediate CA to sign my own certificates https://jamielinux.com/docs/openssl-certificate-authority/index.html\r\n  - I generated a certificate for Consul using the intermediate CA with the following settings\r\n    - extendedKeyUsage = clientAuth, serverAuth (per Consul instructions)\r\n    - Common Name = server.\\<data center\\>.\\<domain\\>\r\n  - I setup my Consul cluster with TLS enabled and the systems cluster no problem\r\n  - I generate a user certificate to access Consul using \"extendedKeyUsage = clientAuth\"\r\n  - I generate a P12 for that\r\n  - Using Curl, I verify that I CANNOT connect to Consul on port 8501 (HTTPS) using the P12\r\n  - I generate a new user certificate to access Consul using \"extendedKeyUsage = clientAuth, serverAuth\"\r\n  - I generate a P12 for that\r\n  - Using Curl, I verify that I CAN connect to Consul on port 8501 (HTTPS) using the P12\r\n  - I standup the Vault cluster using TLS and same certs as Consul (per Vault instructions)\r\n  - I initialize and unseal the Vault\r\n  - I verify Vault is working using curl and my good P12 by calling the health check.  All good\r\n  - I verify that the system does not work if I do not include the certificate meaning TLS is definitely enabled\r\n\r\nSo at this point, my system is fully bootstrapped and I have verified that everything is working correctly using TLS and my good certificate.  Now to use PKI\r\n\r\nI configure vault as follows\r\n\r\n    # Mount the pki\r\n    curl -k --cert $1 -H \"X-Vault-Token:${VAULT_TOKEN}\" \\\r\n        -X POST -d \"{\\\"type\\\": \\\"pki\\\"}\" \\\r\n        $leader/v1/sys/mounts/pki\r\n\r\n    # Configure the CA\r\n    curl -k --cert $1 -H \"X-Vault-Token:${VAULT_TOKEN}\" \\\r\n        -X POST --data \"@cabundle.json\" \\\r\n        $leader/v1/pki/config/ca\r\n\r\n    role=$(echo ${DOMAIN} | sed 's/\\./-/g')\r\n    echo \"Creating role: ${role}\"\r\n\r\n    # Create the roles\r\n    curl -k --cert $1 -H \"X-Vault-Token:${VAULT_TOKEN}\" \\\r\n    -X POST -d \"{ \\\"allowed_base_domain\\\": \\\"${DOMAIN}\\\", \\\"allow_subdomains\\\":true, \\\"max_ttl\\\":\\\"72h\\\", \\\"server_flag\\\": true, \\\"client_flag\\\": true }\" \\\r\n    $leader/v1/pki/roles/$role\r\n\r\nI then issue a certificate as follows\r\n\r\n    curl -k --cert $1 -H \"X-Vault-Token:${VAULT_TOKEN}\" \\\r\n        -X POST -d \"{\\\"common_name\\\": \\\"${3}.${DOMAIN}\\\"}\" \\\r\n        $leader/v1/pki/issue/$role\r\n\r\nI get back the private key, CA, and certificate.  I bundle those up into a P12.  I then use it to access the Vault.\r\n\r\n    curl -k --cert $1 https://${SERVER_BOOTSTRAP_IP}:8200/v1/sys/health\r\n\r\nThis works.  I then use it to access Consul\r\n\r\n    curl -k --cert $1 https://${SERVER_BOOTSTRAP_IP}:8501/v1/status/leader\r\n\r\nThis does not work.  This is behaving identically to if I generate my initial user certificate with \"extendedKeyUsage = clientAuth\" and no \"serverAuth\".\r\n\r\nMy hypothesis is that the generated certificate is not generated with \"serverAuth\" given that it is behaving the same as the certificate that I explicitly generated without server auth (works with Vault, does not work with Consul).  2 questions\r\n\r\n  - How do I confirm this?\r\n  - If this is the case, what more can I do other than set \"server_flag=true\" during the configuration of the PKI?  I also noticed this was the default but for debug I decided to make it explicit.\r\n\r\nThanks"}}