Why can't I configure Https access to my Hashi Vault server? Http works but Https breaks everything

Vault
1

I have been trying all day without success to get Vault to allow https connection.

The configuration is: Ubuntu EC2 AWS server with Vault installed.

WORKING HTTP

I can run Vault and connect by http if I do two things:

  1. set export VAULT_ADDR=http://127.0.0.1:8200 and
  2. in nano /etc/vault.d/vault.hcl set:
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = 1
}

With this configuration I can go to http://ipaddress:8200 or http://domainname.com:8200 and see the vault login page. I can also run vault status & vault operator unseal when needed and unlock the vault and get normal status outputs.

CHANGE TO HTTPS?

Once I try to change to https however, everything breaks down.

The steps I have tried in various combinations are:

  • set export VAULT_ADDR=https://127.0.0.1:8200
  • in nano /etc/vault.d/vault.hcl set:
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = 0
  tls_disable_client_certs = "true"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file = "/opt/vault/tls/tls.key"
}
  • copy my certificate (concatenated as main cert plus bundle certs all in one file) as tls.crt at this path and tls.key for my private key (confirmed they are readable from command line at these file locations also)
  • restart the Vault service with sudo systemctl restart vault
  • try to unseal with vault operator unseal
  • update certs with sudo pkill -SIGHUP vault

However, none of this works. I cannot get vault to run or unseal or provide any useful output once I have made the above changes.

As soon as I update VAULT_ADDR=https://127.0.0.1:8200, comment in the new listener in vault.hcl, and run sudo systemctl restart vault everything is broken.

vault status gives

Error checking seal status: Get "https://127.0.0.1:8200/v1/sys/seal-status": dial tcp 127.0.0.1:8200: connect: connection refused

vault operator unseal allows me to put in a key but then says:

Error unsealing: Put "https://127.0.0.1:8200/v1/sys/unseal": dial tcp 127.0.0.1:8200: connect: connection refused

telnet 127.0.0.1 8200 gives telnet: Unable to connect to remote host: Connection refused

What am I supposed to do? I cannot for the life of me find any reference or anything that can suggest a solution or how this is supposed to work.

Puzzlingly, I also find there is an environmental variable for CAPATH which I do not know the point of.

Are we not supposed to be setting the path to our https certificate and key files in the listener as above? Are we supposed to set it twice?

What might be the missing link? Any help? I am at my wit’s end and can’t solve this. Thanks for any suggestions or ideas of any kind.

4

Further discussion and solutions (as well as recommended “bug” fix) here:

5

Check ownership and perms on your certs.
It had me for a while: they need to be vault:vault readonly