The document discusses the importance of centralized TLS certificate management using HashiCorp's Vault PKI and Cert-Manager, highlighting its critical role in zero trust security. It outlines the challenges of manual PKI processes and demonstrates how Vault can automate certificate requests and updates for various applications. Furthermore, it provides configuration details for PKI and Cert-Manager integration within Kubernetes environments.

1. © HASHICORP
1
Centralized TLS Certificates Management
Using Vault PKI + Cert-Manager
Sai L. Thu
Solutions Architecture
Specialist at HashiCorp

2. © HASHICORP
2
HTTPS with TLS is the defacto standard for all web traffic today.
Zero Trust Security Requirement

3. What is PKI (public key infrastructure)?
• digital certificates to protect sensitive data, provide unique digital identities for
users, devices and applications and secure end-to-end communications.
• Used for websites, load balancers, application servers, Kubernetes, VPNs, IoT,
device identity, etc.
• Plays a critical role in Zero Trust Security strategy for an organization

4. © HASHICORP
Challenges with PKI (Manual process)

5. PKI with Vault
DevOps
Multiple
Teams
App
Developer
Network
Team
DevOps
Certificate live in production
Portal
App
Auto requests
certificate
Vault receives request and
auto generates certificate
Auto updates
resources
Seconds

6. © HASHICORP
6
Vault PKI in Action
DEMO

7. © HASHICORP
Vault PKI Secrets Engine CONFIG
1. PKI Secret Engine mounted at pki/
2. Root CA
3. /pki/roles/hashibox-dot-com
4. vault policy write pki
VAULT PKI SECRETS ENGINE CONFIG

8. © HASHICORP
Enable k8s auth method in Vault
1. PKI Secret Engine mounted at pki/
2. Root CA
3. vault write /pki/roles/hashibox-dot-com
4. vault policy write pki
5. vault write auth/kubernetes/config
6. vault write auth/kubernetes/role/ingress-issuer
VAULT PKI SECRETS ENGINE CONFIG

9. © HASHICORP
Configure Cert-Manager
1. kind: ServiceAccount (ingress-issuer)
2. kind: Secret (ingress-issuer-sa-token)
3. kind: Issuer (vault-issuer)
4. kind: Certificate (hashibox-com)
5. kind: Secret (hashibox-com-tls)
Cert-Manager CONFIG

10. © HASHICORP
Deploy Consul API Gateway
Consul API Gateway

11. © HASHICORP
● Browse our full documentation on Vault PKI secrets engine capabilities
● Get hands-on experience with Vault PKI tutorials
● Reference the PKI secrets engine API
● Learn more about HashiCorp Vault
11
To learn more about Vault’s PKI Capabilities

12. © HASHICORP
12
https://www.hashicorp.com/vault-pki
WHITEPAPER
Modern-Day PKI Management with HashiCorp Vault

13. © HASHICORP
Thank you
hello@hashicorp.com

14. © HASHICORP
Unlock the Cloud Operating Model
14