Unable to set key_type "any" on PKI role

[bluecmd]

Describe the bug
Default for a PKI role seems to be rsa/2048. I want to allow a CSR sign to work for EC and RSA. Trying to set key_type=any (which seems to what the code cares about) results in

* role requires keys of type rsa

To Reproduce

1. vault write test-pki/roles/user ....
2. vault read test-pki/roles/user returns:

...
key_bits                              2048
key_type                              rsa
...

3. Try to sign an EC CSR using vault write test-pki/sign/user.
4. Get error * role requires keys of type rsa

Expected behavior

1. Default is key_type = any
2. If not default, at least setting it should be possible.

Environment:

• Vault Server Version (retrieve with vault status):
  Vault v0.10.1 ('756fdc4587350daf1c65b93647b2cc31a6f119cd')
• Vault CLI Version (retrieve with vault version):
  Vault v0.10.1 ('756fdc4587350daf1c65b93647b2cc31a6f119cd')
• Server Operating System/Architecture:
  Linux Debian testing

[jefferai]

What is the role write command you are using?

[bluecmd]

Example:

vault write browser-pki/roles/user max_ttl=2160h ttl=2160h allow_localhost=false ou=Web server_flag=false allow_any_name=true use_csr_common_name=false use_csr_sans=false

[jefferai]

key_type=any isn't in your command

[bluecmd]

I assumed you meant the writes that succeed to create the role. If I do the above with key_type=any:

root@vault:~/vault# vault write browser-pki/roles/user max_ttl=2160h ttl=2160h allow_localhost=false ou=Web server_flag=false allow_any_name=true use_csr_common_name=false use_csr_sans=false key_type=any
Error writing data to browser-pki/roles/user: Error making API request.

URL: PUT https://[redacted]/v1/browser-pki/roles/user
Code: 400. Errors:

* unknown key type any

[jefferai]

OK, so that ^ is the actual problem!

[bluecmd]

Thanks for the quick fix!