Vault Encryption

---

Vault manages the user credentials for the backend systems.

---

Replace the Pre-Installed Keys

Vault starts in the developers mode after the installation. For security reasons, the following configuration steps are recommended:

1. Configure the settings for the file storage and the data transfer encryption in /opt/seal/infrastructure/config/vault.hcl:

   storage "file" {
     path = "/opt/seal/infrastructure/data/vault/"
   }
   
   listener "tcp" {
     address     = "0.0.0.0:8200"
     tls_disable = false
     tls_cert_file = "/opt/seal/infrastructure/config/tls/cert.pem"
     tls_key_file = "/opt/seal/infrastructure/config/tls/key.pem"
   }
   

2. As administrator, create the root token and the unseal key using the following script:

   • /opt/seal/infrastructure/seal-vault/secure-vault.sh

   Hint - memorize the root token and unseal key

   Memorize the generated root token and the unseal key. You need the unseal key whenever restarting the seal-vault service.

Restart the Seal-Vault Service

• vault operator unseal -format=json -tls-skip-verify <unsealKey>

---