From dbe614f9c3a56499aa4ccd3508549ea17eb17538 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Thu, 4 Jan 2024 15:26:21 +0800
Subject: [PATCH] workflows/use-renew-ssl-certs.yml: update

---
 .github/workflows/use-renew-ssl-certs.yml | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/use-renew-ssl-certs.yml b/.github/workflows/use-renew-ssl-certs.yml
index f64a2fac..1a7f45a2 100644
--- a/.github/workflows/use-renew-ssl-certs.yml
+++ b/.github/workflows/use-renew-ssl-certs.yml
@@ -82,11 +82,15 @@ jobs:
           # Write Certificate and Private Key to Vault
 
           vault login ${VAULT_TOKEN}
-          vault secrets enable -path=${CERT_PATH} pki || true
-          vault write ${CERT_PATH} \
-              common_name=${DOMAIN} \
-              ttl=720h \
-              max_ttl=1680h \
-              certificate=@/etc/ssl/${DOMAIN}.pem \
+          vault secrets disable pki
+          vault secrets destroy pki
+          vault secrets enable pki 
+          vault secrets tune -max-lease-ttl=1680h pki
+          vault secrets enable -path=pki pki || true
+          vault write pki/roles/${DOMAIN} allowed_domains=${DOMAIN} allow_subdomains=true max_ttl=720h
+          vault write pki/issue/${DOMAIN} common_name=${DOMAIN} \
+              ttl=720h                                          \
+              max_ttl=1680h                                     \
+              certificate=@/etc/ssl/${DOMAIN}.pem               \
               private_key=@/etc/ssl/${DOMAIN}.key
           echo "Certificate and private key written to Vault at path: ${CERT_PATH}"