Multiple instances setup

[FinchRelia]

Hi,
I'm looking to build a small cluster of Step-ca instances for HA. I deployed Step-ca on two VMs and configure them to use the same mysql database. However, with this setup I have two PKIs since each instance get initialized with it's own certificate bundle, therefore certificates generated on one side are unknown for the other instance CA's. My understanding of this kind of setup is to be able to run one PKI on several machines connected with the same DB ensuring HA though I wasn't able to read much on this infrastructure type. At this point, I don't really know how to perform this so I'm looking for clarifications.

[maraino]

You can start the second instance with step ca init --root root_ca.crt --key root_ca_key using the files from instance 1.

Another alternative is to use directly step certificate create directly and replace the files.

[FinchRelia]

Okay so in this scenario it's like having two different intermediate CAs trusting the same RootCA even thought there are technically two RootCAs living in separate instances?

[maraino]

Yes, you can also share the same intermediate if you want to, but this gives you a little bit more flexibility. Clients only need the root certificate and a server/client certificate will contain both the leaf and the intermediate of the server that issued the certificate, so clients can build the root of trust of that certificate no matter what intermediate you are using.

After storing the root_ca_key in a safe place, you can also remove root_ca_key from the step-ca instances, they do not need it. The instances only need the root_ca.crt and the intermediate cert and key to operate.