Right now, if I want to use a TLS certificate to authenticate to Vault, I need to have a file with the certificate, and a file with the private key, on my client’s filesystem.
On Windows, I’m able to use the OS to store certificates and private keys securely. I know on MacOS there’s the Keychain, and I presume Linux has one or more similar systems.
I asked support, and they said there isn’t currently a way to do this. Does anyone know of any workarounds or other ways to use an OS-installed cert on Windows?
I have not found any work around to having the files local – in our app we moved secret0 to jks store … it isn’t any better, but better than just a cert and key lying around on the filesystem.
If this is your workstation, have you tried protecting you pvt key with a passprase when you generated them? then it will ask for a passphrase to unlock the key everytime it needs access to it.
Give permission for read only to the service and audit, expensive option hardware device, bear in mind in all os compromising the user password will be able to retrieve the pvt key, even in windows when it is set not to export which most dont do, there are options where they were able to retrieve the pvt key.