CRL Generation problem: followup from https://github.com/hashicorp/vault/issues/20137

Hi,

So this is a follow up from : https://github.com/hashicorp/vault/issues/20137
Which my colleague has raised in the past.

So as per, https://github.com/hashicorp/vault/issues/20137#issuecomment-1511256948

We have created New RootCA with KU Set correctly with same key of Old RootCA. Upgraded vault to latest 1.21.2. And have both Part of Single Mount Path in vault with old RootCA as default issuer.

Now while trying to rotate CRLs i am getting:

`curl "http://root-ca-vault.local/v1/Old-RootCA/crl/rotate" -H "X-Vault-Token: $ROOT_CA_API_TOKEN"

{"request_id":"a28006c7-f5f0-3f88-f9da-4871392e1dee","lease_id":"","renewable":false,"lease_duration":0,"data":{"success":true},"wrap_info":null,"warnings":["Warning 1 during CRL rebuild: warning from local CRL rebuild: Issuer equivalency set with associated keys lacked an issuer with CRL Signing KeyUsage; refusing to rebuild CRL for this group of issuers: "],"auth":null,"mount_type":"pki"}`

And then if i try to get CRL it gives me empty string:

`# curl "http://root-ca-vault.local/v1/Old-RootCA/crl/pem"
#
`

I also did not understood this work around: https://github.com/hashicorp/vault/issues/20137#issuecomment-1511567206

is it like to ticking for old RootCA issuer:
Usage
Allowed usages for this issuer. It can always be read.

Following Option?
Signing CRLs

Start with the linked issue #20137 and its referenced comments, then reproduce the behavior using the /crl/rotate and /crl/pem endpoints described here on Vault 1.21.2. Trace the CRL rebuild warning about issuer equivalency and the CRL Signing KeyUsage setting. Done means establishing whether the empty CRL is expected and documenting or correcting the behavior and workaround.

Written by the indexing model from the issue text.