Adding elliptic curve intermediate to Vault - hashicorp-vault

Question

I am trying to add an existing elliptic curve intermediate CA certificate to Vault using the following
vault write pki/config/ca pem_bundle=#bundle.json
bundle.json contains
{
"pem_bundle":"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n-----BEGIN EC PRIVATE KEY-----\...\n-----END EC PRIVATE KEY-----"
}
this gives the error 'no data found in PEM block' - which I believe is because it is expecting an RSA certificate.
Looking at https://www.vaultproject.io/api-docs/secret/pki
there is a key_type parameter that can be set to EC. but this does not appear to be available for pki/config/ca

Answer 1

The API docs to submit a CA specifically note the following:
Note that if you provide the data through the HTTP API it must be
JSON-formatted, with newlines replaced with \n, like so...
This applies only to the HTTP API (eg: curl ... https://.../v1/pki/config/ca).
However, you are using the vault write CLI command which does the translation from inputs to json format for you. The pem_bundle argument to the CLI command should be a path to a plain .pem file containing the normal PEM-formatted certificate and key. eg:
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
-----BEGIN EC PRIVATE KEY-----
...
...
-----END EC PRIVATE KEY-----
Your final invocation will be:
vault write pki/config/ca pem_bundle=#ca_bundle.pem
Note also that the key_type argument is only needed when a key is being generated by Vault. Since you are providing the key, Vault will properly detect the key type (see certutil.ParsePemBundle).