Vault PKI Certificate Rotation and Keytab Re-issuance

Internal CA Intermediate Certificate Rotation

The lab.franklin internal Certificate Authority's intermediate certificate (issued via HashiCorp Vault PKI engine) was approaching its 365-day expiry window. A controlled rotation was executed to prevent service disruption across all TLS-terminated services:

• New intermediate CSR: Generated via vault write pki/intermediate/sign with the root CA, signed with SHA-256.
• Certificate chain update: Re-issued full certificate chain (root → new intermediate → leaf certs) and updated /etc/vault.d/certs/ca-chain.pem on all Vault cluster nodes.
• Leaf cert regeneration: All service leaf certificates signed against the new intermediate were regenerated using the existing SAN/CN configuration, preserving hostnames and IP addresses without manual updates.

Host Keytab Re-issuance Runbook

With the intermediate CA rotated, associated Kerberos keytabs stored in Stash House's password-store hierarchy needed re-issuance to match the new certificate chain. The automated runbook executed across core nodes:

• skynet: DNS authority — new host principal created via kadmin, keytab extracted and stored under stash key lab/skynet.keytab.
• stargate: Ansible controller — new keytab deployed via the existing distribute_ssh_key.yml infrastructure (reuse principle).
• wonderland: Web deployment target — keytab rotated and verified with kinit -kt.

All three nodes confirmed successful Kerberos ticket acquisition against the new intermediate without manual intervention. Stash House's automated auditing caught no stale credentials in dotfiles or shell history post-rotation.