Configure TLS certificates for mutual authentication

before secure connections between hashicorp vault and the {{k3}} can occur, both parties must establish a mutual trust relationship by validating their respective digitally signed certificates this section describes how to create x 509 certificates for hashicorp vault and the vault client connection pair on the {{k3}} , necessary for tls communication you can use the following optional methods to create the hashicorp vault and vault client connection pair tls certificates use an external ca use the {{k3}} as the ca use an external ca to use an external ca, you must complete the following tasks create a tls certificate for vault import the certificate and chain to the {{k3}} create a tls certificate for the vault connection pair on the {{k3}} the following sections show you how to perform these tasks create a tls certificate perform the following steps to create a tls certificate for hashicorp vault the hashicorp vault client certificate must use the v3 extension tls server authentication generate a private key by running the following openssl command in a terminal openssl genrsa out client privatekey pem 2048 generate a certificate signing request (csr) by running the following openssl command openssl req new key client privatekey pem out client cert req pem days 365 specify the ip address or hostname of the hashicorp vault server as the common name in the csr get an external ca to sign the csr by sending the csr file to the external ca after the csr is signed, download the signed certificate and the chain of ca certificates used to sign it import the signed certificate and chain perform the following steps to import the signed hashicorp vault certificate and chain into a new x 509 certificate container on the {{k3}} log in to the {{k3}} application interface with the default admin identities go to pki > certificate authorities and select \[ add ca ] specify a name for the x 509 certificate container and select \[ ok ] right click the new certificate container and select import > certificate(s) in the import certificates window, select \[ add ] select the signed hashicorp vault certificate and all ca certificates in the certificate chain, and select \[ open ] all certificates should display in a tree form in the verified section of the import certificates window select \[ ok ] to save create a tls certificate to create the tls certificate for the vault client connection pair on {{k3}} , complete the following tasks generate a private key and csr for the connection pair get the external ca to sign the csr configure the connection pair to use the signed csr the following sections show you how to perform these tasks generate a private key and csr perform the following steps to generate a private key and construct a csr for the vault client connection pair log in to the {{k3}} application interface with the default admin identities go to administration > configuration > network options on the tls/ssl settings tab, select the vault client connection pair from the connection drop down menu enable the vault client connection pair if it is not already enabled uncheck use system/host api ssl parameters if it is selected in the user certificates section, select \[ edit ] next to pki keys in the application public keys window, select \[ generate ] when warned that ssl will not be functional until new certificates are installed , select \[ yes ] to continue in the pki parameters window, leave all fields set to the default values and select \[ ok ] it now displays loaded in the application public keys window in the application public keys window, select \[ request ] on the subject dn tab, change the preset drop down option to classic and specify the ip address or hostname of the kmes in the common name field on the v3 extensions tab, set the profile to tls client certificate on the pkcs #10 information tab, specify a save location and name for the csr file, and select \[ ok ] when prompted that the certificate signing request was successfully written to the specified location, select \[ ok ] select \[ ok ] again to save the application public keys settings get an external ca to sign the csr take the csr file to the external ca after the csr is signed, download the signed certificate and the chain of ca certificates used to sign it configure the connection pair perform the following steps to configure the vault client connection pair to use the signed certificate and ca chain log in to the {{k3}} application interface with the default admin identities go to administration > configuration > network options on the tls/ssl settings tab, select vault client from the connection drop down menu in the user certificates section, select \[ edit ] next to certificates in the certificate authority window, right click on the vault client ssl ca x 509 certificate container, and select \[ import ] in the import certificates window, select \[ add ] in the file browser, select both the root ca certificate and the signed vault client connection pair certificate, and select \[ open ] the certificates should now display in the verified section of the import certificates window select \[ ok ] it now says signed loaded next to certificates in the user certificates section select \[ ok ] to save use the {{k3}} as the ca to use the {{k}} as the ca, you must complete the following tasks create the ca create a tls certificate for the vault create and configure the tls certificate for the vault client connection pair the following sections show you how to perform these tasks create the ca log in to the {{k3}} application interface with the default admin users go to pki > certificate authorities and select \[ add ca ] specify a name for the ca and select \[ ok ] the new certificate container now displays in the certificate authorities window right click the new certificate container and select add certificate > new certificate change the preset drop down option to classic and set the common name value to root on the basic info tab, leave all fields set to the default values on the v3 extensions tab, set the profile to certificate authority and select \[ ok ] the root certificate now displays under the certificate container you created create the tls certificate for hashicorp vault to create the tls certificate, you must perform the following steps generate a private key and csr sign the csr the following sections show you how to perform these tasks generate a private key and csr perform the following steps to generate a private key and construct a csr for hashicorp vault in a terminal, run the following openssl command to generate a private key openssl genrsa out client privatekey pem 2048 in a terminal, run the following openssl command to generate a csr, specifying the ip address or hostname of the hashicorp vault server as the common name openssl req new key client privatekey pem out client cert req pem days 365 sign the csr perform the following steps to sign the hashicorp vault csr go to pki > certificate authorities right click the root ca certificate you created and select add certificate > from request in the file browser, select the hashcorp vault csr certificate information populates in the create x 509 from csr window on the v3 extensions tab, set the profile to tls server certificate and select \[ ok ] to save the signed hashicorp vault certificate displays now under the root ca certificate in the ca tree create and configure the tls certificate to create and configure the tls certificate for the vault client connection pair on the {{k3}} , complete the following tasks generate a private key and construct a csr sign the csr export the certificates in the ca tree and add them to the vault client connection pair the following sections show you how to perform these tasks generate a private key and csr perform the following steps to generate a private key and construct a csr for the vault client connection pair log in to the {{k3}} application interface with the default admin identities go to administration > configuration > network options on the tls/ssl settings tab, select the vault client connection pair from the connection drop down menu enable the vault client connection pair if it is not already enabled uncheck use system/host api ssl parameters if it is selected in the user certificates section, select \[ edit ] next to pki keys in the application public keys window, select \[ generate ] when warned that ssl will not be functional until new certificates are installed , select \[ yes ] to continue in the pki parameters window, leave all fields set to the default values and select \[ ok ] it now says loaded in the application public keys window in the application public keys window, select \[ request ] on the subject dn tab, change the preset drop down option to classic and specify the ip address or hostname of the kmes in the common name field on the v3 extensions tab, set the profile to tls client certificate on the pkcs #10 info tab, specify a save location and name for the csr file and select \[ ok ] when prompted that the certificate signing request was successfully written to the specified location , select \[ ok ] select \[ ok ] again to save the application public keys settings sign the csr perform the following steps to sign the vault client connection pair csr go to pki > certificate authorities right click the root ca certificate you created and select add certificate > from request in the file browser, select the vault client connection pair csr certificate information populates in the create x 509 from csr window leave all settings set to the defaults and select \[ ok ] to save the signed vault client connection pair certificate now displays under the root ca certificate in the ca tree export all certificates and import them to export the certificates, right click each certificate in the certificate tree and select export > certificate(s) in the export certificate dialog for each of them, change the encoding to pem , and specify a save location for the file then, perform the following instructions to import them to the vault client connection pair log in to {{k3}} application interface with the default admin identities go to administration > configuration > network options under the tls/ssl settings tab, select vault client from the connection drop down menu in the user certificates section, select \[ edit ] next to certificates in the certificate authority window, right click on the vault client ssl ca x 509 certificate container and select \[ import ] in the import certificates window, select \[ add ] in the file browser, select both the root ca certificate and the signed vault client connection pair certificate, and select \[ open ] the certificates should now display in the verified section of the import certificates window select \[ ok ] it now says signed loaded next to certificates in the user certificates section select \[ ok ] to save