El Baúl

root@Hashicorp-Vault:~ # vault read cubbyhole/mi.secreto

Error reading cubbyhole/mi.secreto: Error making API request.

URL: GET http://192.168.1.21:8200/v1/cubbyhole/mi.secreto
Code: 503. Errors:

* Vault is sealed (1)

root@Hashicorp-Vault:/ # vault read cubbyhole/mi.secreto
Error making API request.

URL: GET http://addreess/v1/sys/internal/ui/mounts/secret/my-secret
Code: 403. Errors:

* permission denied

root@Hashicorp-Vault:~ # vault read cubbyhole/mi.secreto
Key     Value
---     -----
test    mi.secreto

vault kv put secret/myapp my.property=mySecretValue

vault kv put path \ (1)
/myapp \            (2)
my.property         (3)
=mySecretValue      (4)

curl --location 'http://ip:8200/v1/cubbyhole/mi.secreto' \
--header 'Accept: */*' \
--header 'Accept-Language: es,en;q=0.9,fr;q=0.8,zh-TW;q=0.7,zh-CN;q=0.6,zh;q=0.5' \
--header 'Connection: keep-alive' \
--header 'DNT: 1' \
--header 'Referer: http://ip:8200/ui/vault/secrets/cubbyhole/list' \
--header 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36' \
--header 'X-Vault-Token: YourToken' (1)

{
    "request_id": "8ac9f6c5-9f08-12f3-ed87-70de1ab96842",
    "lease_id": "",
    "renewable": false,
    "lease_duration": 0,
    "data": {
        "test": "mi.secreto" (1)
    },
    "wrap_info": null,
    "warnings": null,
    "auth": null,
    "mount_type": "cubbyhole" (2)
}

postgresql://user:password@ip_address:port/database?

[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
x509_extensions    = v3_ca

[ dn ]
CN = vault.server.local

[ v3_ca ]
subjectKeyIdentifier   = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints       = critical, CA:true
keyUsage               = critical, keyCertSign, cRLSign

openssl genpkey -algorithm RSA -out ca-key.pem (1)
openssl req -x509 -new -nodes -key ca-key.pem -out ca-cert.pem -days 3650 -config ca.conf (2)

[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
x509_extensions    = v3_req

[ dn ]
CN = la-ip (1)

[ v3_req ]
subjectAltName = @alt_names

[ alt_names ]
IP.1 = la-ip
DNS.1 = vault.server.local

openssl req -x509 -newkey rsa:2048 -nodes -keyout vault-key.pem -out vault-cert.pem -days 365 -config vault-cert.conf

Generating a RSA private key
.................+++++
...........................................................................................................................+++++
writing new private key to 'vault-key.pem'
-----

openssl genpkey -algorithm RSA -out vault-key.pem (1)
openssl req -new -key vault-key.pem -out vault-req.csr -config vault-cert.conf (2)
(3)
openssl x509 -req -in vault-req.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out vault-cert.pem -days 365 -sha256 -extfile vault-cert.conf -extensions v3_req

Signature ok
subject=CN = ip (1)
Getting CA Private Key

[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
req_extensions     = v3_req

[ dn ]
CN = vault-client

[ v3_req ]
subjectAltName = @alt_names
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth

[ alt_names ]
DNS.1 = cliente.local

openssl genpkey -algorithm RSA -out client-key.pem (1)
(2)
openssl req -new -key client-key.pem -out client-req.csr -config client.conf
(3)
openssl x509 -req -in client-req.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 365 -sha256 -extfile client.conf -extensions v3_req

openssl pkcs12 -export -out client-cert.p12 -inkey client-key.pem -in client-cert.pem -certfile ca-cert.pem -name "Vault Client Cert"

openssl pkcs12 -export \  (1)
-out client-cert.p12 \    (2)
-inkey client-key.pem \   (3)
-in client-cert.pem \     (4)
-certfile ca-cert.pem \   (5)
-name "Vault Client Cert" (6)

listener "tcp" {
  address            = "192.168.1.21:8200"
  tls_cert_file      = "/ruta/a/vault-cert.pem" (1)
  tls_key_file       = "/ruta/a/vault-key.pem"  (2)
  tls_client_ca_file = "/ruta/a/ca-cert.pem"    (3)
}

storage "file" {
  path    = "/var/db/vault"
  node_id = "v"
}

api_addr = "https://ip:8200"
ui       = true

sudo cp vault-cert.crt /usr/local/share/ca-certificates/vault-cert.crt (1)
sudo update-ca-certificates (2)
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
rehash: warning: skipping vault-cert.pem,it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt

awk \                                   (1)
-v cmd='openssl x509 -noout -subject' \ (2)
'/BEGIN/{close(cmd)}; \                 (3)
{print | cmd}' \                        (4)
< /etc/ssl/certs/ca-certificates.crt    (5)

subject=C = US, O = Amazon, CN = Amazon Root CA 1
subject=C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA

curl -k https://192.168.1.21:8200/v1/sys/health

{
  "initialized": true,
  "sealed": true,
  "standby": true,
  "performance_standby": false,
  "replication_performance_mode": "unknown",
  "replication_dr_mode": "unknown",
  "server_time_utc": 1739132639,
  "version": "1.18.3",
  "enterprise": false,
  "echo_duration_ms": 0,
  "clock_skew_ms": 0,
  "replication_primary_canary_age_ms": 0
}

➜  ~ curl \
  --header "X-Vault-Token: ${VAULT_TOKEN}" \
  --request GET \
  https://192.168.1.21:8200/v1/${API_PATH} (1)
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

➜  ~ curl -k --cert-type P12 --key client-cert.p12 \
  --header "X-Vault-Token: ${VAULT_TOKEN}" \
  --request GET \
  https://vault.server.local:8200/v1/${PATH_SECRET}

==== salida

{
  "request_id": "f2a77063-189c-2c29-2df8-8952962f0dc5",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "data": {
      "secret.": "value" (1)
    },
    "metadata": {
      "created_time": "2025-01-31T02:05:03.750285314Z",
      "custom_metadata": null,
      "deletion_time": "",
      "destroyed": false,
      "version": 9
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null,
  "mount_type": "kv"
}

listener "tcp" {
  address = "ip-address:8200"
  tls_cert_file = "/root/vault-cert.pem"
  tls_key_file  = "/root/vault-key.pem"
  tls_client_ca_file = "/root/ca-cert.pem"
  tls_disable_client_certs = false  # Forzar autenticación de cliente
  tls_min_version = "tls12"
  tls_require_and_verify_client_cert = "true" (1)
}

➜  ~ curl --cert client-cert.pem --key client-key.pem --cacert ca-cert.pem \ (1)
  --header "X-Vault-Token: ${VAULT_TOKEN}" \
  --request GET \
  https://vault.server.local:8200/v1/${PATH_SECRET}

==== salida

{
  "request_id": "f2a77063-189c-2c29-2df8-8952962f0dc5",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "data": {
      "secret.": "value" (2)
    },
    "metadata": {
      "created_time": "2025-01-31T02:05:03.750285314Z",
      "custom_metadata": null,
      "deletion_time": "",
      "destroyed": false,
      "version": 9
    }
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null,
  "mount_type": "kv"
}

export VAULT_ADDR=https://direccion-ip:8200
export VAULT_CLIENT_CERT=/path/client-cert.pem
export VAULT_CLIENT_KEY=/path/client-key.pem
export VAULT_CACERT=/path/ca-cert.pem
export VAULT_TOKEN=token (1)

path "app/data/test" {
capabilities = ["read", "list"]
}

path "app/metadata/test" {
capabilities = ["list"]
}