How to get private key out of vault

Vault
1

Hi All,

I am very new to hashicorp vault and have few basic question:

  1. using transit secret engine , is there a way to get private key the way we get public key : GET /transit/keys/:name.

This is required as we are still trying to use own crypto service but use vault for only creating/storing/updating key materials.

2

Hi @sunil001repo!

You have to mark the key exportable (https://www.vaultproject.io/api/secret/transit/index.html#exportable) during key creation/generation.
Afterwards, you can use the key export API endpoint (https://www.vaultproject.io/api/secret/transit/index.html#export-key) to export the private key.

Cheers,
Michel

1 Like
3

Thanks Michel. This is what I was looking for :smile:

5

Just to tag on to this, once the key is made exportable, this can not be reveresed.

6

Hi All,
In the web UI, there’s a wrap response for exporting the key. I’ve tried to find the documentation about this but couldn’t find any. My question is can we export the key with wrap response using API? I didn’t see a parameter to enable the wrap response on the documentation. Transit - Secrets Engines - HTTP API | Vault | HashiCorp Developer

thank you