# Designing Vault Agent + PKI + External System (DataPower) for Automated Certificate Rotation

**URL:** <https://discuss.hashicorp.com/t/designing-vault-agent-pki-external-system-datapower-for-automated-certificate-rotation/77292>\
**Category:** Vault\
**Created:** [March 30, 2026, 1:27pm UTC](https://discuss.hashicorp.com/t/designing-vault-agent-pki-external-system-datapower-for-automated-certificate-rotation/77292 "2026-03-30T13:27:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunny.kumar](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sunny.kumar/32/44076_2.png) [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\
**Post date:** [March 30, 2026, 1:27pm UTC](https://discuss.hashicorp.com/t/designing-vault-agent-pki-external-system-datapower-for-automated-certificate-rotation/77292/1 "2026-03-30T13:27:59Z")

</div>

Hi everyone,

I’m designing an automated certificate rotation system using HashiCorp Vault PKI and Vault Agent, and I’d like feedback on the architecture and best practices.

**Current setup:**

- Vault Enterprise (AppRole auth enabled)

- Vault Agent configured with auto-auth (AppRole) and file sink (`/tmp/vault_token`)

- Secret ID configured with:

- Vault Agent successfully authenticates and renews token

**Use case:**

- I have external systems (IBM DataPower) that store certificates

- A Python script:

**Goal:**  
I want to offload as much work as possible to Vault Agent while keeping dynamic behavior.

**Questions:**

1. Is this hybrid approach (Vault Agent for auth + script for logic) the recommended pattern?

2. Can Vault Agent be used to dynamically generate certificates (based on runtime input like cert names), or is it limited to static templates?

3. Is using a long-lived (unlimited use) `secret_id` for Vault Agent considered safe for this use case?

4. Would it be better to:

5. Any best practices for:

**What I’ve observed:**

- Vault Agent works well for auth/token lifecycle

- Dynamic certificate generation still requires application logic

Would appreciate guidance on whether this architecture aligns with recommended Vault design patterns.

Thanks!