HashiCorp Vault PKI with TigerTrust
TigerTrust provides comprehensive integration with HashiCorp Vault PKI secrets engine for private certificate lifecycle management.
Vault PKI Integration
Connect TigerTrust to Vault PKI:
- PKI Engine: Full integration with Vault PKI
- Dynamic Certificates: Support for short-lived certificates
- Multi-Mount: Manage multiple PKI mounts
- Cross-Cluster: Certificate sync across clusters
Configuration
Configure Vault PKI with:
- Vault address and authentication method (Kubernetes, token, or AppRole)
- PKI mount path and role
- Auto-renewal settings (renew at percentage of TTL)
- TTL and max TTL settings
Certificate Lifecycle
Dynamic Certificates: Issue short-lived certificates on demand with configurable TTL.
Auto-Renewal:
- Monitor certificate expiration
- Automatic renewal at threshold
- Zero-downtime rotation
Vault PKI Hierarchy
Structure your PKI with:
- Root CA (offline, highest security)
- Issuing CAs per cluster or environment
- End entity certificates for services
Kubernetes Integration
Vault Agent Injector: Inject certificates into pods with automatic renewal using Vault annotations.
cert-manager Integration: Use Vault as a ClusterIssuer with cert-manager for native Kubernetes certificate management.
Short-Lived Certificate Patterns
Sidecar Pattern: Vault Agent as a sidecar watches files and renews certificates automatically, reloading applications when certificates change.
Auto-Renewal: Configure automatic certificate renewal at a percentage of TTL (typically 70%).
Monitoring
Audit Logging: Enable Vault audit logging for complete certificate operation visibility.
Metrics: Monitor key Vault PKI metrics including tidy operations, sign and issue counts.
Best Practices
- Use short TTLs - Hours, not days or weeks
- Separate intermediates - Different CAs for different use cases
- Enable audit logging - Track all certificate operations
- Automate renewal - Vault Agent handles this automatically
- Use Kubernetes auth - Leverage native K8s authentication
- Monitor expiration - Even short-lived certs need monitoring
Getting Started
- Configure Vault PKI: Set up PKI secrets engine
- Create Roles: Define certificate issuance roles
- Configure Auth: Set up TigerTrust authentication
- Add Integration: Configure Vault in TigerTrust
- Enable Automation: Start certificate management
TigerTrust's Vault PKI integration enables enterprises to leverage Vault's powerful PKI capabilities with enhanced automation and monitoring.