Update README.md

README.md

@@ -125,5 +125,65 @@ docker exec -it openbao-app bao policy read terraform
   docker exec -it 3710711b3c37 vault list identity/entity/id
 ~~~
 
+# PKI
+
+## init
+
+~~~bash
+  docker exec -it openbao-app bao secrets enable pki
+  docker exec -it openbao-app bao secrets tune -max-lease-ttl=87600h pki
+  docker exec -it openbao-app bao secrets list | grep pki
+~~~
+
+~~~bash
+  docker exec -it openbao-app bao write -field=certificate pki/root/generate/internal \
+    common_name="Tips Of Mine Root CA" \
+    issuer_name="root-2026" \
+    key_type="ec" \
+    key_bits=384 \
+    ttl=87600h > /root/ca-root.crt
+~~~
+
+~~~bash
+  docker exec -it openbao-app bao write pki/config/urls \
+    issuing_certificates="https://openbao.tips-of-mine.com/v1/pki/ca" \
+    crl_distribution_points="https://openbao.tips-of-mine.com/v1/pki/crl"
+~~~
+
+~~~bash
+  docker exec -it openbao-app bao secrets enable -path=pki_int pki
+  docker exec -it openbao-app bao secrets tune -max-lease-ttl=43800h pki_int
+
+  # génération de la demande, signature par la racine, réinjection — en une passe
+  docker exec -i openbao-app sh <<'EOF'
+  set -e
+  bao write -field=csr pki_int/intermediate/generate/internal \
+    common_name="Tips Of Mine Intermediate CA" \
+    issuer_name="int-2026" key_type=ec key_bits=384 > /tmp/int.csr
+  bao write -field=certificate pki/root/sign-intermediate \
+    csr=@/tmp/int.csr format=pem_bundle ttl=43800h > /tmp/int.crt
+  bao write pki_int/intermediate/set-signed certificate=@/tmp/int.crt
+  rm -f /tmp/int.csr /tmp/int.crt
+  EOF
+
+  docker exec -it openbao-app bao write pki_int/config/urls \
+    issuing_certificates="https://openbao.tips-of-mine.com/v1/pki_int/ca" \
+    crl_distribution_points="https://openbao.tips-of-mine.com/v1/pki_int/crl"
+~~~
+
+~~~bash
+  docker exec -it openbao-app bao write pki_int/roles/tips-of-mine \
+    allowed_domains="tips-of-mine.com,tips-of-mine.org" \
+    allow_subdomains=true \
+    allow_bare_domains=true \
+    key_type="ec" key_bits=256 \
+    max_ttl="2160h"
+~~~
+
+~~~bash
+  docker exec -it openbao-app bao write pki_int/issue/tips-of-mine \
+    common_name="test.tips-of-mine.org" ttl="24h"
+~~~
+
 # Buy me a coffe
 <a href='https://ko-fi.com/R5R2KNI3N' target='_blank'><img height='36' style='border:0px;height:36px;' src='https://storage.ko-fi.com/cdn/kofi4.png?v=3' border='0' alt='Buy Me a Coffee at ko-fi.com' /></a>