StepCA RA mode with Vault – “root certificate not found” when CA chain is incomplete

[lsimard]

Hi ! I’m running into an issue with step-ca in RA mode using HashiCorp Vault as the backend CA. At startup, step-ca fails with:
error unmarshaling vault response: root certificate not found

From the Vault logs, step-ca is calling: GET /v1/<pki_mount>/cert/ca_chain

My understanding of the problem is that vault returns only the intermediate CAs, but the external root CA is missing from /cert/ca_chain. The root private key is intentionally kept outside Vault, but the public root cert is also not present in the chain. This causes step-ca to refuse to start, as it expects a complete CA chain ending with a root.

Is there any way in step-ca (RA mode) to explicitly configure or provide a missing root CA, or is step-ca strictly dependent on Vault returning a full chain?
Or is this definitively a Vault PKI import issue (chain imported without the public root cert)?

Thanks!

[sueun-dev]

looks like this is the Vault issuer chain, not a step-ca RA config knob.

I checked current vaultcas and repro'd it with Vault dev 1.21: if <mount>/cert/ca_chain only returns the intermediate, VaultCAS.GetCertificateAuthority() dies with root certificate not found. After importing the public root into that PKI mount, the same endpoint returned intermediate + self-signed root and vaultcas accepted it.

So the root private key can stay outside Vault, but the public root cert still needs to be in the issuer chain Vault returns. For a freshly signed intermediate:

{ cat int1.crt; printf '\n'; cat root_ca.crt; } > intermediate_ca.crt
vault write pki_int1/intermediate/set-signed certificate=@intermediate_ca.crt

The printf is just to avoid gluing two PEM blocks together if int1.crt has no trailing newline.

For your existing mount I'd check the real response first:

vault read -format=json <pki_mount>/cert/ca_chain | jq -r .data.certificate | step certificate inspect --bundle

If that bundle stops at the intermediate, update/import the issuer chain so the default issuer's ca_chain ends at the public root matching certificateAuthorityFingerprint.