cfssl root CA with intermediate

ca-generate.sh

#!/bin/bash

set -eu

CA_NAME=${CA_NAME:-ca}

# generate a root CA:
cfssl gencert -initca config-root.json | cfssljson -bare "${CA_NAME}"
rm "${CA_NAME}.csr"

# generate an intermediate CA:
cfssl gencert -initca config-intermediate.json | cfssljson -bare "${CA_NAME}-intermediate"
cfssl sign -ca ca.pem -ca-key ca-key.pem \
    -config profiles.json \
    -profile intermediate_ca \
    "${CA_NAME}-intermediate.csr" | cfssljson -bare "${CA_NAME}-intermediate"
rm "${CA_NAME}-intermediate.csr"

cert-generate.sh

#!/bin/bash

CA_NAME=${CA_NAME:-ca}

cfssl gencert \
    -ca "${CA_NAME}-intermediate.pem" \
    -ca-key "${CA_NAME}-intermediate-key.pem" \
    -config profiles.json \
    -profile=peer service.json | cfssljson -bare service-peer

cfssl gencert \
    -ca "${CA_NAME}-intermediate.pem" \
    -ca-key "${CA_NAME}-intermediate-key.pem" \
    -config profiles.json \
    -profile=server service.json | cfssljson -bare service-server

cfssl gencert \
    -ca "${CA_NAME}-intermediate.pem" \
    -ca-key "${CA_NAME}-intermediate-key.pem" \
    -config profiles.json \
    -profile=client service.json | cfssljson -bare service-client

config-intermediate.json

{
    "CN": "Intermediate CA",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "C": "DE",
        "L": "Monschau",
        "O": "CA",
        "OU": "Intermediate CA",
        "ST": "Germany"
    }]
}

config-root.json

{
    "CN": "Root CA",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "C": "DE",
        "L": "Monschau",
        "O": "CA",
        "OU": "Root CA",
        "ST": "Germany"
    }]
}

profiles.json

{
    "signing": {
        "default": {
            "expiry": "8760h"
        },
        "profiles": {
            "intermediate_ca": {
                "usages": [
                    "signing",
                    "digital signature",
                    "key encipherment",
                    "cert sign",
                    "crl sign",
                    "server auth",
                    "client auth"
                ],
                "expiry": "8760h",
                "ca_constraint": {
                    "is_ca": true,
                    "max_path_len": 0, 
                    "max_path_len_zero": true
                }
            },
            "peer": {
                "usages": [
                    "signing",
                    "digital signature",
                    "key encipherment", 
                    "client auth",
                    "server auth"
                ],
                "expiry": "8760h"
            },
            "server": {
                "usages": [
                    "signing",
                    "digital signing",
                    "key encipherment",
                    "server auth"
                ],
                "expiry": "8760h"
            },
            "client": {
                "usages": [
                    "signing",
                    "digital signature",
                    "key encipherment", 
                    "client auth"
                ],
                "expiry": "8760h"
            }
        }
    }
}

service.json

{
    "CN": "service.namespace.svc.cluster.local",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "C": "DE",
        "L": "Monschau",
        "O": "Service",
        "OU": "Service Hosts",
        "ST": "Germany"
    }],
    "hosts": [
        "service.namespace.svc.cluster.local",
        "localhost"
    ]
}