Select one of the credentials created as explained in Creating a credential.

Selecting a HashiCorp credential requires configuring the following additional fields.

​Unique password per host

Enable this option if each host in the inventory has its own unique credentials stored as a separate secret in HashiCorp Vault; disable otherwise

Mandatory: ​No. This option is disabled by default.

Base Path of Secrets in Vault

When enabling ​Unique password per host, enter the Vault folder that contains a secret for each destination host. For example:

/secret

Certificate Manager automatically appends each host identifier from the inventory file to this base path to locate the corresponding secret.

If the inventory has aliases, Certificate Manager resolves the secret paths as follows.

Sample inventory with host aliases
web1  10.1.128.44
web2  10.1.128.49 
Resolved credential paths
/secret/web1
/secret/web2

For an inventory without aliases, Certificate Manager resolves the secret paths as follows.

Sample inventory without host aliases
10.1.128.44
10.1.128.49 
Resolved credential paths
/secret/10.1.128.44
/secret/10.1.128.49

 For Vault KV version 2 engines, Certificate Manager automatically appends /data to the base path before resolving the secret paths. For example:

/secret/data/web1
/secret/dataweb2
/secret/data/10.1.128.44
/secret/data/10.1.128.49

Mandatory: When enabling ​Unique password per host. 

Absolute Path to Secret in Vault

When disabling ​Unique password per host, enter the complete path to a single secret in Vault that contains the credentials shared by all hosts in the inventory. For example:

/secret/shared-credentials

 For Vault KV version 2 engines, Certificate Manager automatically appends /data to this path. For example:

/secret/shared-credentials/data

Mandatory: When disabling ​Unique password per host. 

Vault Secret Key for Username

The key name within the Vault secret that holds the username value. 

For example, for a Vault secret with the following contents, set this value to user.

Sample Vault with username and password
{
"user": "admin",
"pass": "<password>"
}

Mandatory: No. This option defaults to username.

SSH Authentication Type

The mechanism for Certificate Manager to authenticate using the credentials retrieved from Vault. 

Selecting Password requires configuring the following setting.

Setting

Value

Default

Vault Secret Key for Password

The name of the Vault secret that holds the password value

password

Selecting Private Key requires configuring the following settings.

Setting

Value

Default

Vault Secret Key for Private Key

The name of the Vault secret that holds the private key content

private_key

Private Key Password Required

Enable if the private key stored in Vault is passphrase-protected; disable otherwise

Disabled

Vault Secret Key for Private Key Password

The name of the Vault secret that holds the passphrase for the private key

private_key_password

Mandatory: Yes.

Sudo Required

If Certificate Manager needs to escalate privileges on the remote host after SSH authentication, enable this option and configure the following setting.

Setting

Value

Default

Vault Secret Key for Sudo Password

The name of the Vault secret that holds the sudo (become) password

become_password

Disable this option otherwise.

Mandatory: No. When Certificate Manager needs to escalate privileges.