# Vault in Prod mode starts in Sealed state after installation **URL:** \ **Category:** Vault\ **Created:** [July 6, 2022, 7:55am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652 "2022-07-06T07:55:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![timjar3](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/timjar3/32/29229_2.png) [@timjar3](https://discuss.hashicorp.com/u/timjar3)\ **Post date:** [July 6, 2022, 7:55am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/1 "2022-07-06T07:55:13Z")
I installed vault in prod mode, using this configuration - ```auto ui = true #mlock = true #disable_mlock = true storage "file" { path = "/opt/vault/data" } # HTTPS listener listener "tcp" { address = "0.0.0.0:8200" tls_disable = 1 tls_cert_file = "/opt/vault/tls/tls.crt" tls_key_file = "/opt/vault/tls/tls.key" } ``` * * * after running the vault.service and checking for vault status, It is pre initialised and sealed and unable to unseal it. Please help ```auto vault status Key Value --- ----- Seal Type shamir Initialized true Sealed true Total Shares 3 Threshold 2 Unseal Progress 0/2 Unseal Nonce n/a Version 1.11.0 Build Date 2022-06-17T15:48:44Z Storage Type file HA Enabled false ``` ---
**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\ **Post date:** [July 6, 2022, 10:03am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/2 "2022-07-06T10:03:02Z")
You can run [`hcdiag`](https://releases.hashicorp.com/hcdiag/) to see if it can detect any permission or filesystem issues. The detail – `/opt/vault/data` should have 3 directories in it, all owned by the user that started Vault – most likely there is either an ownership or permission issue there. ---
**Author:** ![timjar3](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/timjar3/32/29229_2.png) [@timjar3](https://discuss.hashicorp.com/u/timjar3)\ **Post date:** [July 6, 2022, 10:49am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/3 "2022-07-06T10:49:37Z")
- I could find 3 directories inside `/opt/vault/data` - changed the ownership and permissions - tried to regenerate master token with the below command, but throws an error. $ vault operator generate-root -generate-otp Error getting root generation status: Error making API request. URL: GET [http://127.0.0.1:8200/v1/sys/generate-root/attempt](http://127.0.0.1:8200/v1/sys/generate-root/attempt) Code: 503. Errors: - Vault is sealed ---
**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\ **Post date:** [July 6, 2022, 11:21am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/4 "2022-07-06T11:21:11Z")
Your vault is sealed. you have to unseal it. Run that hcdiag tool. ---
**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\ **Post date:** [July 6, 2022, 6:32pm UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/5 "2022-07-06T18:32:51Z")
> [@timjar3](#): > > It is pre initialised Vault does not pre initialise. I can think of two possibilities: - You are running Vault with some kind of custom wrapper that does this. - Or, you have started up Vault with a data directory from a previous experiment, that was initialised. ---
**Author:** ![timjar3](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/timjar3/32/29229_2.png) [@timjar3](https://discuss.hashicorp.com/u/timjar3)\ **Post date:** [July 7, 2022, 5:30am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/6 "2022-07-07T05:30:35Z")
Thanks max for the reply - not sure about the wrapper, I doubt that as it was a clean install. - I made sure to delete /opt/vault/data directory or any vault sub folder before reinstalling. - This is demo install on a prod server, - Why do I not see any certs being generated on starting vault.service in the tsl folder. Not sure, What am I missing . ---
**Author:** ![timjar3](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/timjar3/32/29229_2.png) [@timjar3](https://discuss.hashicorp.com/u/timjar3)\ **Post date:** [July 7, 2022, 5:32am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/7 "2022-07-07T05:32:37Z")
Thanks Aram for the reply, Will try this out and update. ---
**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\ **Post date:** [July 7, 2022, 5:38am UTC](https://discuss.hashicorp.com/t/vault-in-prod-mode-starts-in-sealed-state-after-installation/41652/8 "2022-07-07T05:38:30Z")
> [@timjar3](#): > > Why do I not see any certs being generated on starting vault.service in the tsl folder That’s a typo for `tls` I assume? Why would you expect to see certs being generated? Vault doesn’t automatically generate certificates and write them to disk. * * * > [@timjar3](#): > > ```auto > Initialized true > > ``` There’s really no way to explain this other than: - You manually initialized Vault - Someone else manually initialized Vault - Some software, that is not the main Vault binary itself, initialized Vault