HashiCorp Vault — PKI Secrets Engine
The PKI secrets engine turns Vault into a Certificate Authority (CA), issuing and managing X.509 certificates for TLS, mTLS, and service identity.
What’s in This Chapter?
| # | Topic | Description |
|---|---|---|
| 1 | Vault as a CA | Why use Vault for PKI, architecture overview |
| 2 | Root & Intermediate CA | Building a two-tier CA hierarchy |
| 3 | Issuing Certificates | Roles, certificate issuance, and automation |
| 4 | Certificate Rotation | Auto-renewal patterns, short-lived certs |
| 5 | mTLS | Mutual TLS for service-to-service security |
| 6 | Practice Exercises | 5 hands-on exercises |
Why Vault for PKI?
| Traditional CA | Vault PKI |
|---|---|
| Manual CSR process (days) | API-driven issuance (seconds) |
| Long-lived certs (1-2 years) | Short-lived certs (hours-days) |
| CRL management headache | Automatic revocation with short TTLs |
| Spreadsheet-based tracking | Full audit trail |
| Expensive commercial CAs | Free, self-hosted |
PKI Architecture
┌──────────────────────────────────────┐
│ Root CA (offline) │
│ Mounted at: pki/ │
│ TTL: 10 years │
│ Signs: Intermediate CA cert only │
└──────────────┬───────────────────────┘
│ Signs
┌──────────────▼───────────────────────┐
│ Intermediate CA (online) │
│ Mounted at: pki_int/ │
│ TTL: 3 years │
│ Signs: End-entity certificates │
└──────────────┬───────────────────────┘
│ Issues
┌──────────────▼───────────────────────┐
│ End-Entity Certificates │
│ TTL: 24h-30d │
│ Used by: web servers, services, │
│ mTLS clients │
└──────────────────────────────────────┘
Chapter Flow
Start with Vault as a CA for the conceptual foundation.
Next: Vault as a CA
