content_image/701155.jpg content_image/701154.jpg
The keyring_hashicorp  plugin requires a secure connection to the HashiCorp Vault server, employing the HTTPS protocol. A typical setup includes a set of certificate and key files: 

• company.crt : A custom CA certificate belonging to the organization. This file is used both by HashiCorp Vault server and the keyring_hashicorp  plugin. 

• vault.key : The private key of the HashiCorp Vault server instance. This file is used by HashiCorp Vault server. 

• vault.crt : The certificate of the HashiCorp Vault server instance. This file must be signed by the organization CA certificate. 

The following instructions describe how to create the certificate and key files using OpenSSL. (If you already have those files, proceeed to HashiCorp Vault Setup.) The instructions as shown apply to Linux platforms and may require adjustment for other platforms. 

<img src='content_image/701155.jpg'>

1. Prepare the company and HashiCorp Vault server keys. 

Use the following commands to generate the key files: 

openssl genrsa -aes256 -out company.key 4096 openssl genrsa -aes256 -out vault.key 2048 

<img src='content_image/701154.jpg'>

## Important 

Certificates generated by these instructions are self-signed, which may not be very secure. After you gain experience using such files, consider obtaining certificate/key material from a registered certificate authority. 

The commands produce files holding the company private key ( company.key ) and the Vault server private key ( vault.key ). The keys are randomly generated RSA keys of 4,096 and 2,048 bits, respectively. 

Each command prompts for a password. For testing purposes, the password is not required. To disable it, omit the -aes256  argument. 

The key files hold sensitive information and should be stored in a secure location. The password (also sensitive) is required later, so write it down and store it in a secure location. 

(Optional) To check key file content and validity, use the following commands: 

openssl rsa -in company.key -check openssl rsa -in vault.key -check 

2. Create the company CA certificate. 

Use the following command to create a company CA certificate file named company.crt  that is valid for 365 days (enter the command on a single line): 

openssl req -x509 -new -nodes -key company.key -sha256 -days 365 -out company.crt 

If you used the -aes256  argument to perform key encryption during key generation, you are prompted for the company key password during CA certificate creation. You are also prompted for information about the certificate holder (that is, you or your company), as shown here: 

Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: 

