By default, all APIs in the Cryptographic Security Platform Vault for Secrets use https://<VAULT_IP_or_FQDN>/vault/1.0/API_COMMAND for the API endpoint. When you enable mTLS and want to use digital certificate authentication, you will need to change your API endpoint to https://<VAULT_IP_or_FQDN>/vault/mtls/1.0/API_COMMAND. If you do not, the API command will work, but will not use mTLS.
If you disable mTLS, you will need to switch the endpoint back to https://<VAULT_IP_or_FQDN>/vault/1.0/API_COMMAND.
Examples:
Create a client certificate
Post: https://<VAULT_IP_or_FQDN>/vault/1.0/CreateClientCertificate
Request payload:
Copy{
"csr": "csr content",
"expiry_days": "20",
"key_size": null,
"name": "client1",
"passphrase": "password@1234"
}Create a box
Post: https://<VAULT_IP_or_FQDN>/vault/mtls/1.0/CreateBox
Request payload:
Copy{
"checkout_secapproval": {
"access_window": 660,
"approvers": [
"approver1@domain.com",
"approver2@domain.com"
],
"min_approvals": 2,
"request_expiry_window": 660,
"whitelist_users": [
"user@domain.com",
"user2@domain.com"
]
},
"description": "ESXi Secrets Box",
"exclusive_checkout": true,
"lease": {
"duration": "P3Y6M4DT12H30M5S",
"renewable": true
},
"max_secret_versions": 5,
"name": "box1",
"rotation": {
"duration": "P3Y6M4DT12H30M5S",
"force": true,
"on_checkin": true
},
"secret_duration": "P3Y6M4DT12H30M5S",
"tags": {
"hytrust": "security"
}
}Create a secret
Post: https://<VAULT_IP_or_FQDN>/vault/mtls/1.0/CreateSecret
Request payload:
Copy{
"box_id": "box1",
"desc": "ESXi server 1 credentials",
"exclusive_checkout": true,
"expires_at": "2020-09-04T22:04:16.162848Z",
"lease": {
"duration": "P3Y6M4DT12H30M5S",
"renewable": true
},
"name": "secret1",
"rotation": {
"duration": "P3Y6M4DT12H30M5S",
"force": true,
"on_checkin": true
},
"secret_config": {
"ca_cert": "-----BEGIN CERTIFICATE-----MIIEczCCA1ugAwIBAgIBADANBgkqhkiG9w0BAQQFADAkGA1UEBhMCR0IxEzARBgNVBAgTClNvbWUtU3RhdGUxFDASBgNVBAoTC00EgTHRkMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnXRpb24gQXV0aG9yaXR5MRQwEgYDVQQDEwtCZXN0IENBIEx0ZDAeFw0wMDTUwMTZaFw0wMTAyMDQxOTUwMTZaMIGHMQswCQYDVQQGEwJHQjETMBEGA129tZS1TdGF0ZTEUMBIGA1UEChMLQmVzdCBDQSBMdGQxNzA1BgNVBAsTLkDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFDAMTC0Jlc3QgQ0EgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgTz2mr7SZiAMfQyuvBjM9OiJjRazXBZ1BjP5CE/Wm/Rr500PRK+Lh9x5eJ/ANBE0sTK0ZsDGMak2m1g7oruI3dY3VHqIxFTz0Ta1d+NAjwnLe4nOb7/k05ShhBrJGBKKxb8n104o/5p8HAsZPdzbFMIyNjJzBM2o5y5A13wiLitEfyYkQzaxCw0AwzlkVHiIyCuaF4wj571pSzkv6sv+4IDMbT/XpCo8L6wTash+etLD6FtTjYbbrvZ8RQM1tlKdoMHg2qxraAV++HNBYmNWs0duEdjUbJXI9TtnS4o1Ckj7POfljiQIDAQABo4HnMIHkMB0GA1UdDgQWBBQ8urMCRL5AkIp9NJHJw5TCBtAYDVR0jBIGsMIGpgBQ8urMCRLYYMHUKU5AkIp9NJHaSBijCBhzELMAkGA1UEBhMCR0IxEzARBgNVBAgTClNvbWUtU3RhdGUxFDAoTC0Jlc3QgQ0EgTHRkMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRQwEgYDVQQDEwtCZXN0IENBIEDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4IBAQC1uYBcsSncwADCsQer772C2ucpXxQUE/C0pWWm6gDkwd5D0DSMDJRqV/weoZ4wC6B73f5bLhGYHaXJeSD6KrXcoOwLdSaGmJYslLKZB3ZIDEp0wYTGhgteb6JFiTtnsf2xdrYfPCiIB7gBMAV7Gzdc4VspS6ljrAhbiiawdBiQlQmsBeFz9JkF4b3l8BoGN+qMa56YIt8una2gY4l2O//on88r5IWJlm1L0oA8e4fR2yrBHXadsGeFKkyNrwGi/7vQMfXdGsRrXNGRGnX+vWDZ3/zWI0joDtCkNnqEpVnHoX-----END CERTIFICATE-----",
"master_secret": {
"box_id": "b1",
"secret_id": "s1"
},
"tls_version": "1.2"
},
"secret_data": {
"host": "s1.esxi.hytrust.com",
"password": "Hytrust",
"uid": "root"
},
"secret_subtype_info": {
"info": {
"filename": "cacert.pem"
},
"type": "file"
},
"secret_type": "managed",
"tags": {
"hytrust": "security"
}
}