Use Hashicorp Vault CA with CA Service

This page contains a sample provided for demonstration purposes. Google does not officially support this sample. Carefully evaluate any solution before deploying it in your production environment.

Hashicorp Vault lets you manage and store secrets on-premises. This page provides information about how you can configure Hashicorp Vault CA to act as a proxy that forwards all certificate issuance requests to Certificate Authority Service. This configuration allows a currently deployed solution to work natively with CA Service.

The Vault plugin for CA Service issues certificates through Hashicorp Vault by generating the private key and certificate signing request (CSR), or by receiving a user-provided CSR. The plugin doesn't perform create and delete CA operations, or manage other aspects of the certificate authority (CA) lifecycle.

At a high level, the plugin acts as a proxy to issue certificates.

Note: The Vault plugin doesn't retain any public or private key that is generated during certificate issuance. The certificate requester should retain the certificate and keys that the Vault plugin generates.

Using the Vault plugin has the following advantages:

• Administrators can use a familiar workflow and the existing access-control list (ACL) permissions in the Vault.
• The administrator can define who gets to request certificates and what specifications and limits those certificates have.

For more information about setting up and using the plugin, see the README: Vault Plugin for CA Service.

What's next

• GitHub: Vault Plugin for CA Service
• Hashicorp Vault documentation