Manage client encryption keys with Vault as a KMIP server

1. Enable the kmip secrets engine.

   $ vault secrets enable kmipSuccess! Enabled the kmip secrets engine at: kmip/

2. Configure the kmip server to listen on port 5696.

   $ vault write kmip/config \     listen_addrs=0.0.0.0:5696 \     server_hostnames=$(echo ${VAULT_ADDR:8} | rev | cut -c6- | rev)

   Example output:

   Success! Data written to: kmip/config

3. Review the kmip secrets engine configuration.

   $ vault read kmip/configKey                            Value---                            -----default_tls_client_key_bits    256default_tls_client_key_type    ecdefault_tls_client_ttl         336hlisten_addrs                   [0.0.0.0:5696]server_hostnames               [localhost]server_ips                     [127.0.0.1 ::1]tls_ca_key_bits                256tls_ca_key_type                ectls_min_version                tls12

   When the KMIP engine is configured, it generates and stores a key-pair and uses it to sign a root CA which is used to sign an intermediate CA. The intermediate CA is used to sign the server TLS certificate used by the KMIP listener to identify itself during the TLS handshake.

   By default, the certificate type (default_tls_client_key_type) is ec (Elliptic Curve). If you need RSA instead, specify the certificate type (tls_ca_key_type) and bits (tls_ca_key_bits) when you configure the kmip server.

   $ vault write kmip/config listen_addrs=0.0.0.0:5696 \      tls_ca_key_type="rsa" \      tls_ca_key_bits=2048

4. Retrieve the generated CA certificate and save it in a file named vault-ca.pem.

   $ vault read kmip/ca -format=json | jq -r '.data | .ca_pem' >> vault-ca.pem && cat vault-ca.pem-----BEGIN CERTIFICATE-----MIIBrDCCAVKgAwIBAgIUepWIXt6CqCLoUEPLVbjyO2q7ihEwCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgxNzIxMDA0NFoXDTMzMDgxNDIxMDExNFowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABI16pHn0LoN59b/fxHxBnEmhioKODmhO94e86rNVJRsDY1Zz8BO2nZ4/HiHVESCfU249J5nd84yNaZZC9MYhIG2jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRSHkNkRvVRuTu9PkX6rz4WbQStyjAfBgNVHSMEGDAWgBT97Fucze6351ekJtoz2fu0Y822kTAKBggqhkjOPQQDAgNIADBFAiEAxtAsabBtZn2Cm01ozELcv17qsKCljeXsArsOUYlMJRECIF4HUTqL4QiYDsgPwDiOtMeNNMkaICYA1RufLYKys+nE-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIBnjCCAUWgAwIBAgIUST+/bF6Ux5G61KbflBK9S2WgkA8wCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgxNzIxMDA0NFoXDTMzMDgxNDIxMDExNFowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElo0QMG2krqdKw6CcYEQdsHGMYrtORGAgO2oxNRQ31voALba9sA5LX5NvAZMwvXxT5iOYzOEITj5Mwbjwn1+SlKNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3sW5zN7rfnV6Qm2jPZ+7RjzbaRMB8GA1UdIwQYMBaAFP3sW5zN7rfnV6Qm2jPZ+7RjzbaRMAoGCCqGSM49BAMCA0cAMEQCIBSUi8dNc2eMznzURznq9kmvwf1EhyxwPyCuJC3cJoQ6AiBrlBWn8oBDTMU0mtNmanvD242WNakeEiWWtRZQshPBYg==-----END CERTIFICATE-----

1. Enable kmip secrets engine using the /sys/mounts endpoint.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     --data '{"type":"kmip"}' \     $VAULT_ADDR/v1/sys/mounts/kmip

2. Use the kmip/config endpoint to configure the Vault KMIP server to listen to port 5696.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     --data '{"listen_addrs": "0.0.0.0:5696", "server_hostnames": "'"$(echo ${VAULT_ADDR:8} | rev | cut -c6- | rev)"'"}' \     $VAULT_ADDR/v1/kmip/config

3. Read the kmip secrets engine configuration.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     $VAULT_ADDR/v1/kmip/config | jq

   Example output:

   {  # ...snip...  "data": {      "default_tls_client_key_bits": 256,      "default_tls_client_key_type": "ec",      "default_tls_client_ttl": 1209600,      "listen_addrs": [        "0.0.0.0:5696"      ],      "server_hostnames": [        "localhost"      ],      "server_ips": [        "127.0.0.1",        "::1"      ],      "tls_ca_key_bits": 256,      "tls_ca_key_type": "ec",      "tls_min_version": "tls12"    },  # ...snip...}

   When the KMIP engine is configured, it generates and stores a key-pair and uses it to sign a root CA which is used to sign an intermediate CA. The intermediate CA is used to sign the server TLS certificate used by the KMIP listener to identify itself during the TLS handshake.

   By default, the certificate type (default_tls_client_key_type) is ec (Elliptic Curve). If you need RSA instead, specify the certificate type (tls_ca_key_type) and bits (tls_ca_key_bits) in the API request body.

   $ tee payload.json <<EOF{  "listen_addrs": "0.0.0.0:5696",  "tls_ca_key_type": "rsa",  "tls_ca_key_bits": 2048}EOFcurl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     --data @payload.json \     $VAULT_ADDR/v1/kmip/config

4. Invoke the kmip/ca endpoint to retrieve the generated CA certificate and save it in a file named vault-ca.pem.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     $VAULT_ADDR/v1/kmip/ca | jq -r '.data | .ca_pem' >> vault-ca.pem \     && cat vault-ca.pem

   Example output:

   -----BEGIN CERTIFICATE-----MIIBrDCCAVKgAwIBAgIUY/yh1A7rIzKS8iEaH4FLvHBVtY0wCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgyMTE4NDg0OVoXDTMzMDgxODE4NDkxOVowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABK9AbHo78vQDoQUSVFnKFs9Vm1SMfiM1paLd45NfXYMpRYNa4kGz/P6ahurkGojKbw1uSZumSkP812nD8z6IuAKjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqh0zk/JEz5uJS6Tkw1hPOSMEgqTAfBgNVHSMEGDAWgBSpFcwffEqkiNPBUvMLi+pGs8EuiTAKBggqhkjOPQQDAgNIADBFAiBp8oK4bSU27QiHPJQWIccsclNticERtT+B7ifp/BMLMgIhAObLVNHZHAhYywVG1CKt06802cdG/VYUgjMLQ3ZljjZ8-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIBnzCCAUWgAwIBAgIUHDh25jG9IpvI6Kbfc3mK2OOe9UIwCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgyMTE4NDg0OVoXDTMzMDgxODE4NDkxOVowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKWr1k+99jpbvQgB1i6vZr/4dqtHQkeaZUUAPyLF74aK12STTYD4uLBnyRBo/42pl+qtEgnNFPQ0j8snQdbg5sKNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKkVzB98SqSI08FS8wuL6kazwS6JMB8GA1UdIwQYMBaAFKkVzB98SqSI08FS8wuL6kazwS6JMAoGCCqGSM49BAMCA0gAMEUCIQD61XB/tMKxF2yp2OskfUQozmqPUmmFF6uEs726WI8sGQIgBWgwAL/wfzeQvwRXk8ULBYmJs4vg/sSd5gAQXrjfKoc=-----END CERTIFICATE-----

1. Open a web browser, navigate to the Vault UI and then login.

2. Select Enable new engine.

3. Select KMIP from the list, and then click Next.

4. Click Enable Engine to complete. This sets the path to be kmip.

5. Select the Configuration tab, and then click Configure.

   

6. Set the Listen addrs value to 0.0.0.0:5696, and leave the rest as their defaulted values.

7. Click Save.

   

8. Click Download CA cert and save it as ca.pem for this demonstration.

   

1. Create a new scope named, "finance".

   $ vault write -f kmip/scope/financeSuccess! Data written to: kmip/scope/finance

2. List the existing scopes.

   $ vault list kmip/scopeKeys----finance

3. Create a new role, "accounting" under the finance scope.

   $ vault write kmip/scope/finance/role/accounting operation_all=trueSuccess! Data written to: kmip/scope/finance/role/accounting

   By setting the operation_all parameter to true, the created role is granted to perform all KMIP client-server operations. Refer to Manage KMIP roles to learn how to modify the allowed operation list.

4. List existing roles under finance scope.

   $ vault list kmip/scope/finance/roleKeys----accounting

5. Read the accounting role definition.

   $ vault read kmip/scope/finance/role/accountingKey                    Value---                    -----operation_all          truetls_client_key_bits    0tls_client_key_ttl     0stls_client_key_type    n/a

1. Invoke the kmip/scope endpoint to create a new scope named, "finance".

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     $VAULT_ADDR/v1/kmip/scope/finance

2. List the existing scopes.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request LIST \     $VAULT_ADDR/v1/kmip/scope | jq

   Example output:

   {  # ...snip...  "data": {    "keys": [      "finance"    ]  },  # ...snip...}

3. Invoke the kmip/scope/<scope_name>/role/<role_name> endpoint to create a new role, "accounting" under the finance scope.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     --data '{"operation_all": true}' \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting

   By setting the operation_all parameter to true, the created role is granted to perform all KMIP client-server operations. Refer to [Step 6][step-6] to learn how to modify the allowed operation list.

4. List existing roles under finance scope.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request LIST \     $VAULT_ADDR/v1/kmip/scope/finance/role | jq

   Example output:

   {  # ...snip...  "data": {    "keys": [      "accounting"    ]  },  # ...snip...}

5. Read the accounting role definition:

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting | jq

   Example output:

   {  # ...snip...    "data": {      "operation_all": true,      "tls_client_key_bits": 0,      "tls_client_key_ttl": 0,      "tls_client_key_type": ""    },  # ...snip...}

1. In the UI select kmip under Secrets.

2. Select Create a scope.

3. Enter finance in the Name field, and click Save.

4. Select the newly created finance scope, and click Create a role.

5. Enter accounting in the Name field. Allow this role to perform all operations should be enabled.

6. Click Save.

1. Generate a certificate in PEM format, and save it in a file named credential.json.

   $ vault write -format=json \    kmip/scope/finance/role/accounting/credential/generate \    format=pem > credential.json && cat credential.json

   The resulting credential.json contains the certificates that your KMIP client will use to establish a connection with Vault KMIP server.

   Example output:

   {  "request_id": "e646483b-dcf2-392e-75a2-d10292f59794",  "lease_id": "",  "lease_duration": 0,  "renewable": false,  "data": {    "ca_chain": [      "-----BEGIN CERTIFICATE-----\nMIIBrDCCAVKgAwIBAgIUGvBNoVCx0BLGTrRiAemINa7...snip...Cg+6nuyvvFcXugK3xSHggqNtxetN9e+0qOjcPj\n-----END CERTIFICATE-----",      "-----BEGIN CERTIFICATE-----\nMIIBnzCCAUWgAwIBAgIUJjJ9lnQUbw5DpMHYQFlfLF1...snip...abcdefvGnymqlYzWohhlC5FCpm7Enesh5zP2s=\n-----END CERTIFICATE-----"    ],    "certificate": "-----BEGIN CERTIFICATE-----\nMIIBwTCCAWegAwIBAgIUWXc97Ip/n6...snip...BOAjBI4wCgYIKoZIzj0EAwIw\nKjEoMCYGA1UE\n-----END CERTIFICATE-----",    "private_key": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIG7y7BwxdAyMH5C4O0U...snip...NHuGbafWWYEmebCi7bfJ5PDwzoAoGCCqGSM49=\n-----END EC PRIVATE KEY-----",    "serial_number": "51075936162212341123456128960130371031336078"  },  "warnings": null}

2. Extract the certificate from the credential.json using jq tool and save it in a file named cert.pem.

   $ jq -r .data.certificate < credential.json > cert.pem

3. Extract the private key from the credential.json using jq tool and save it in a file named key.pem.

   $ jq -r .data.private_key < credential.json > key.pem

4. List the certification serial numbers associated with the accounting role.

   $ vault list kmip/scope/finance/role/accounting/credentialKeys----693751915900546682090704263335075174345458639865

5. You can lookup the client certificate by its serial number as shown in the example. You can copy the output from the command above, or retrieve it from the credential.json file.

   $ vault read kmip/scope/finance/role/accounting/credential/lookup \        serial_number=$(cat credential.json | jq -r '.data | .serial_number')

   Example output:

   Key              Value---              -----ca_chain         [-----BEGIN CERTIFICATE-----MIIBrDCCAVKgAwIBAgIUGvBNoVCx0BLGTrRiAemINa7R+QswCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgxODE5MTI1MVoXDTMzMDgxNTE5MTMyMVowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJ+5g1hmjyHThog1ee3zZe8ic+5TRvQaK+/a+RpSoYd9knm5P6EvAQk7wwneJorfEGUIBO0/TN3Xt9/UskECN1ijYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSX/jXsZE3doA7ojZyt66hhAezL0jAfBgNVHSMEGDAWgBSNgA4syZP7tYXlpu6zZL5Iu4DHLDAKBggqhkjOPQQDAgNIADBFAiB34g33groCphFs9STd6ek6lBBD7eo0Rx9OxIU/e6zIMwIhAOuOOeCg+6nuyvvFcXugK3xSHggqNtxetN9e+0qOjcPj-----END CERTIFICATE----- -----BEGIN CERTIFICATE-----MIIBnzCCAUWgAwIBAgIUJjJ9lnQUbw5DpMHYQFlfLF1QO74wCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgxODE5MTI1MVoXDTMzMDgxNTE5MTMyMVowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHvD9qvfjxRP4iNPGhcV97rytanI0UmUtTCCF4iXtRuGgnFAXJ/BX1TeYHbp+cAJdRUPjAqJKyctPCLKxzDSp+KNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI2ADizJk/u1heWm7rNkvki7gMcsMB8GA1UdIwQYMBaAFI2ADizJk/u1heWm7rNkvki7gMcsMAoGCCqGSM49BAMCA0gAMEUCIQD+DdOrTFBp0Afi7KUrA2b20rASZm/5+MpDzJx6mJyP4gIgDDZVLrhnIw0ZvGnymqlYzWohhlC5FCpm7Enesh5zP2s=-----END CERTIFICATE-----]certificate      -----BEGIN CERTIFICATE-----MIIBwTCCAWegAwIBAgIUWXc97Ip/n6P/fpQCD8fjBOAjBI4wCgYIKoZIzj0EAwIwKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0yMzA4MTgxOTEzMjRaFw0yMzA5MDExOTEzNTRaMCAxDjAMBgNVBAsTBTJ6N2t4MQ4wDAYDVQQDEwUxMjRHcDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAUFSs6y21W2sBl8ERYAaBH07wGXVtakyWwTLD8Z5Hs+Wwb+kj117e9XT3IK+NM10TS5hnvNUkrBMMdrxKWmSaijdTBzMA4GA1UdDwEB/wQEAwIDqDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT2PNwt8EQeEtwjHaUtXSqEJRxBnDAfBgNVHSMEGDAWgBSX/jXsZE3doA7ojZyt66hhAezL0jAKBggqhkjOPQQDAgNIADBFAiAydpj1p2u9ZXS8ImDuFO1H7tD6zFey53SgkXmk/cFkUAIhAODOZL+ajtd3yvSNZj7SKWcP53VlMeWIO11BPd/uKSHF-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIBrDCCAVKgAwIBAgIUGvBNoVCx0BLGTrRiAemINa7R+QswCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgxODE5MTI1MVoXDTMzMDgxNTE5MTMyMVowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJ+5g1hmjyHThog1ee3zZe8ic+5TRvQaK+/a+RpSoYd9knm5P6EvAQk7wwneJorfEGUIBO0/TN3Xt9/UskECN1ijYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSX/jXsZE3doA7ojZyt66hhAezL0jAfBgNVHSMEGDAWgBSNgA4syZP7tYXlpu6zZL5Iu4DHLDAKBggqhkjOPQQDAgNIADBFAiB34g33groCphFs9STd6ek6lBBD7eo0Rx9OxIU/e6zIMwIhAOuOOeCg+6nuyvvFcXugK3xSHggqNtxetN9e+0qOjcPj-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIBnzCCAUWgAwIBAgIUJjJ9lnQUbw5DpMHYQFlfLF1QO74wCgYIKoZIzj0EAwIwHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTIzMDgxODE5MTI1MVoXDTMzMDgxNTE5MTMyMVowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHvD9qvfjxRP4iNPGhcV97rytanI0UmUtTCCF4iXtRuGgnFAXJ/BX1TeYHbp+cAJdRUPjAqJKyctPCLKxzDSp+KNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI2ADizJk/u1heWm7rNkvki7gMcsMB8GA1UdIwQYMBaAFI2ADizJk/u1heWm7rNkvki7gMcsMAoGCCqGSM49BAMCA0gAMEUCIQD+DdOrTFBp0Afi7KUrA2b20rASZm/5+MpDzJx6mJyP4gIgDDZVLrhnIw0ZvGnymqlYzWohhlC5FCpm7Enesh5zP2s=-----END CERTIFICATE-----serial_number    510759361622123415542856862128960130371031336078

1. Use the kmip/scope/<scope_name>/role/<role_name>/credential/generate endpoint to generate a certificate in PEM format, and save it in a JSON file named, credential.json.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \    --header "X-Vault-Namespace: $VAULT_NAMESPACE" \    --request POST \    --data '{"format": "pem"}' \    $VAULT_ADDR/v1/kmip/scope/finance/role/accounting/credential/generate \    > credential.json

2. Extract the certificate from the credential.json using jq tool and save it in a file named cert.pem.

   $ jq -r .data.certificate < credential.json > cert.pem

3. Extract the private key from the credential.json using jq tool and save it in a file named key.pem.

   $ jq -r .data.private_key < credential.json > key.pem

   The resulting cert.pem and key.pem is what your KMIP client will use to establish a connection with Vault KMIP server.

4. Use the kmip/scope/<scope_name>/role/<role_name>/credential endpoint to list the certification serial numbers associated with the accounting role:

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request LIST \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting/credential | jq

   Example output:

   {  # ...snip...  "data": {    "keys": [      "592363246796376126217488264600013543918961277098"    ]  },  # ...snip...}

5. Use the kmip/scope/<scope_name>/role/<role_name>/credential/lookup endpoint to lookup the client certificate by its serial number using the output from the command above, or retrieve it from the credential.json file.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request GET \      $VAULT_ADDR/v1/kmip/scope/finance/role/accounting/credential/lookup\?serial_number\=$(cat credential.json | jq -r '.data | .serial_number') | jq

   Example output:

   {  # ...snip...  "data": {    "ca_chain": [      "-----BEGIN CERTIFICATE-----\nMIIBrDCCAVKgAwIBAgIUA462iIHn2ssIOwZTFDzMaWK8veIwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDczMDE5NDYwOFoX\nDTI5MDcyNzE5NDYzOFowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu\ndGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKpAQgXZZQ5YSXZ7\nQiDaSXrbig7AT5xqKw4Cpos1RHNnQtQmFzj4VJdIJfFF3j7+iXjg/4DfQEvsgjfk\nOPsR5FSjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud\nDgQWBBTXOnbANc7zQbeXut8z/gW6z1D9+zAfBgNVHSMEGDAWgBRo5cF5kF7WN4Dp\nMjlRbvJoRqgNHzAKBggqhkjOPQQDAgNIADBFAiA3W9E5Q40/Ys1CgXgrDx1ywIJm\nu7JZ8pg0mahQ60jItwIhALLnHRVXfIXKYGouRCwJ6tZeEYCZXL5SC6W6r5fZcJq7\n-----END CERTIFICATE-----",      "-----BEGIN CERTIFICATE-----\nMIIBoDCCAUWgAwIBAgIUH/kEhPmsA19HwWyaUe5+6MbSNPwwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDczMDE5NDYwOFoX\nDTI5MDcyNzE5NDYzOFowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MFkw\nEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/IIHo7wm0G5ywwsU9I2/fzfcjEac8k+K\nsatRSL71/SxY4Af4GiBdVHSNqTv/QEq3kfe4ShKQvK0tGo2xjxu39KNjMGEwDgYD\nVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjlwXmQXtY3\ngOkyOVFu8mhGqA0fMB8GA1UdIwQYMBaAFGjlwXmQXtY3gOkyOVFu8mhGqA0fMAoG\nCCqGSM49BAMCA0kAMEYCIQCxhqAELYdXfIi7H8yJ6RCaNRntaHbHwqxn6UB4fnEc\nHQIhAM5qsuyvbp6U8CH+ejtbHjzzgO5rhXbchx7Um2gWKiEQ\n-----END CERTIFICATE-----"    ],    "certificate": "-----BEGIN CERTIFICATE-----\nMIIBszCCAVmgAwIBAgIUT4XoB0JqAPoADTK3lb1NbJKUk3QwCgYIKoZIzj0EAwIw\nKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0x\nOTA3MzAyMDI5MzdaFw0xOTA4MTMyMDMwMDdaMCAxDjAMBgNVBAsTBUtJRUdXMQ4w\nDAYDVQQDEwU5akpiZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPM977vYKmIy\nUDTNlWJhQ+3poZrEYt/bH1t0GpUinfHHBSifkG0v/boM85BOLku8S/zURZRQlXXa\nD6FONeSHCmWjZzBlMA4GA1UdDwEB/wQEAwIDqDATBgNVHSUEDDAKBggrBgEFBQcD\nAjAdBgNVHQ4EFgQUlyQPSXDXzarQ4uD87xIHsQs8BJwwHwYDVR0jBBgwFoAU1zp2\nwDXO80G3l7rfM/4Fus9Q/fswCgYIKoZIzj0EAwIDSAAwRQIgRm8doJMK5Wy46fMW\n2iqUfn5cykVF0h/78mKts3/Vp5YCIQDJBfh5kGmDZKTCLAZeiiSd07mkF56FzIK1\n2HFT4nBZCg==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIBrDCCAVKgAwIBAgIUA462iIHn2ssIOwZTFDzMaWK8veIwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDczMDE5NDYwOFoX\nDTI5MDcyNzE5NDYzOFowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu\ndGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKpAQgXZZQ5YSXZ7\nQiDaSXrbig7AT5xqKw4Cpos1RHNnQtQmFzj4VJdIJfFF3j7+iXjg/4DfQEvsgjfk\nOPsR5FSjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud\nDgQWBBTXOnbANc7zQbeXut8z/gW6z1D9+zAfBgNVHSMEGDAWgBRo5cF5kF7WN4Dp\nMjlRbvJoRqgNHzAKBggqhkjOPQQDAgNIADBFAiA3W9E5Q40/Ys1CgXgrDx1ywIJm\nu7JZ8pg0mahQ60jItwIhALLnHRVXfIXKYGouRCwJ6tZeEYCZXL5SC6W6r5fZcJq7\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIBoDCCAUWgAwIBAgIUH/kEhPmsA19HwWyaUe5+6MbSNPwwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDczMDE5NDYwOFoX\nDTI5MDcyNzE5NDYzOFowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MFkw\nEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/IIHo7wm0G5ywwsU9I2/fzfcjEac8k+K\nsatRSL71/SxY4Af4GiBdVHSNqTv/QEq3kfe4ShKQvK0tGo2xjxu39KNjMGEwDgYD\nVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjlwXmQXtY3\ngOkyOVFu8mhGqA0fMB8GA1UdIwQYMBaAFGjlwXmQXtY3gOkyOVFu8mhGqA0fMAoG\nCCqGSM49BAMCA0kAMEYCIQCxhqAELYdXfIi7H8yJ6RCaNRntaHbHwqxn6UB4fnEc\nHQIhAM5qsuyvbp6U8CH+ejtbHjzzgO5rhXbchx7Um2gWKiEQ\n-----END CERTIFICATE-----",    "serial_number": "453996482527080083111899601311492596313963664244"  },  # ...snip...}

1. Under Secrets, select kmip > finance > accounting in the UI.

2. Select Generate credentials.

3. The Certificate format is set to pem.

4. Click Save.

5. Select Copy certificate to copy the generated certificate. Save it in a file named, cert.pem.

6. Click on the copy to clipboard icon to copy the private key. Save the copied private key in the key.pem file.

7. Select Back to role and notice that the serial number of the client certificate you just generated is listed. Copy the serial number.

1. Revoke a client certificate by its serial number.

   $ vault write kmip/scope/finance/role/accounting/credential/revoke \        serial_number=$(cat credential.json | jq -r '.data | .serial_number')

   Example output:

   Success! Data written to: kmip/scope/finance/role/accounting/credential/revoke

2. Verify that it no longer exists.

   $ vault list kmip/scope/finance/role/accounting/credentialNo value found at kmip/scope/finance/role/accounting/credential/

1. Use the kmip/scope/<scope_name>/role/<role_name>/credential/revoke endpoint to revoke a client certificate by its serial number.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     --data '{"serial_number": "'"$(cat credential.json | jq -r '.data | .serial_number')"'"}' \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting/credential/revoke

2. Verify that it no longer exists.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request LIST \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting/credential | jq

   Example output:

   { "errors": []}

1. Under Secrets, select kmip > finance > accounting in the UI.

2. Select the serial number to view the client certificate.

3. Select the Revoke credentials. At the confirmation dialog, click Revoke.

1. Update the accounting role and grant only Activate, Create, and Get operations.

   $ vault write kmip/scope/finance/role/accounting \        operation_activate=true \        operation_create=true \        operation_get=true

   Example output:

   WARNING! The following warnings were returned from Vault:  * operation_all overwritten by newly provided operation value(s)

2. Verify the changes.

   $ vault read kmip/scope/finance/role/accountingKey                    Value---                    -----operation_activate     trueoperation_create       trueoperation_get          truetls_client_key_bits    0tls_client_key_ttl     0stls_client_key_type    n/a

3. Delete the accounting role.

   $ vault delete kmip/scope/finance/role/accounting

1. Update the accounting role and grant only Activate, Create, and Get operations.

   First, create an API request payload.

   $ tee payload.json <<EOF{  "operation_activate": true,  "operation_create": true,  "operation_get": true}EOF

2. Update the accounting role.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request POST \     --data @payload.json \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting

   Example output:

   {    "request_id": "63867b67-0119-82a9-5bf0-4fccc476266c",    "lease_id": "",    "renewable": false,    "lease_duration": 0,    "data": null,    "wrap_info": null,    "warnings": ["operation_all overwritten by newly provided operation value(s)"],    "auth": null}

3. Verify the changes.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting | jq

   Example output:

   {  # ...snip...  "data": {      "operation_activate": true,      "operation_create": true,      "operation_get": true,      "tls_client_key_bits": 0,      "tls_client_key_ttl": 0,      "tls_client_key_type": ""  },  # ...snip...}

4. Delete the accounting role using the kmip/scope endpoint.

   $ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request DELETE \     $VAULT_ADDR/v1/kmip/scope/finance/role/accounting

1. Under Secrets, select kmip > finance > accounting in the UI.

2. Select Details and then Edit role.

3. Deselect the Allow this role to perform all operations check box and then select the check-box for Create, Activate and Get.

4. Select Save.

5. To delete the accounting role, select Delete role. At the confirmation dialog, select Delete.

Delete the finance scope.

$ vault delete kmip/scope/finance force=true

The force parameter allows deleting a scope which has some managed objects created with.

Delete the finance scope.

$ curl --header "X-Vault-Token: $VAULT_TOKEN" \     --header "X-Vault-Namespace: $VAULT_NAMESPACE" \     --request DELETE \     $VAULT_ADDR/v1/kmip/scope/finance

The force parameter allows deleting a scope which has some managed objects created with.

1. Under Secrets, select kmip in the UI.

2. Expand the menu for finance scope, and select Delete scope. At the confirmation dialog, click Delete.