HashiCorp Vault — Vault as a CA
1 minute read
Vault’s PKI secrets engine makes it a full-featured Certificate Authority capable of issuing X.509 certificates via API, CLI, or UI.
When to Use Vault PKI
| Scenario |
Use Vault PKI? |
| Internal service-to-service TLS |
✅ Yes — ideal use case |
| mTLS between microservices |
✅ Yes — automate with short-lived certs |
| Development/staging TLS |
✅ Yes — quick and free |
| Public-facing websites |
❌ No — use Let’s Encrypt or a public CA |
| IoT device certificates |
✅ Yes — API-driven mass issuance |
PKI Concepts
| Term |
Definition |
| Root CA |
The top-level certificate authority. Signs intermediate CAs. |
| Intermediate CA |
Signs end-entity certificates. If compromised, root is unaffected. |
| End-entity cert |
The actual TLS certificate used by services. |
| CSR |
Certificate Signing Request — a request to have a cert signed. |
| CRL |
Certificate Revocation List — list of revoked certificates. |
| OCSP |
Online Certificate Status Protocol — real-time revocation checking. |
Enable PKI
# Root CA mount
vault secrets enable pki
# Set max lease TTL (10 years for root)
vault secrets tune -max-lease-ttl=87600h pki
# Intermediate CA mount
vault secrets enable -path=pki_int pki
# Set max lease TTL (3 years for intermediate)
vault secrets tune -max-lease-ttl=26280h pki_int
PKI Endpoints
| Endpoint |
Description |
pki/root/generate/internal |
Generate root CA |
pki/intermediate/generate/internal |
Generate intermediate CSR |
pki/root/sign-intermediate |
Sign intermediate with root |
pki_int/roles/ROLE |
Create certificate issuance roles |
pki_int/issue/ROLE |
Issue a certificate |
pki_int/revoke |
Revoke a certificate |
pki/crl |
Get CRL |
pki/ca |
Get CA certificate |
Quick Reference
| Command |
Description |
vault secrets enable pki |
Enable PKI engine |
vault secrets tune -max-lease-ttl=87600h pki |
Set max TTL |
vault read pki/ca/pem |
Get CA certificate |
vault read pki/crl |
Get CRL |
Next: Root & Intermediate CA
