Noob question: bootstrapping Vault. How to provide TLS certificates needed by storage backend

[fhemberger]

Had a similar issue, came up with this idea:

How to move Vault into his own intermediate?

Hi @mouglou, I hope you are still reading this, since I just came up with a similar idea. Setup a three-node Vault cluster with internal storage (thus circumventing the Consul setup). Generate some short-lived “bootstrap” certificates for each node using Ansible. Create Vault intermediate CA, importing the root certificate. Use consul-template to request a new certificate for each node, write them to disk and restart/SIGHUP vault. I’m still not sure if this is “clever” or incredibly st…

I plan on creating short lived bootstrap certificates (in Ansible) and switch them out with one created by Vault later using consul-template or the vault agent and restart the node.