Setting up for the HashiCorp Vault PKI application

Do not manually create the HashiCorp Vault PKI application objects. Start by setting up your HashiCorp Vault and completing the following high-level tasks using Certificate Manager - Self-Hosted web interface, or the Web SDK.

  1. In HashiCorp, set up permissions. For more information, see HashiCorp Vault permission requirements.

  2. In HashiCorp, enable the TLS option.

  3. Create a Policy folder to hold the objects that will be created. Be sure to grant the API caller the required permissions. These permissions are required by the HashiCorp Vault PKI WebSDK methods.
  4. Create a Password credential where the HashiCorp Vault token is the password. For help with creating credentials, see the Administration Guide.
  5. Identify a CA template that is capable of issuing CA certificates. Example, the SubCA Template of a Microsoft CA.
  6. Create credentials for the chosen CA template.
  7. Create a CA template and test enrollment of a subordinate CA certificate.
  8. (Optional) Create PKI roles by calling POST PKI/HashiCorp/Role. You can assign existing roles to HashiCorp Vault PKI applications at the time of creation or add them later.