Appendices

vault status

Displays the current Vault initialization and seal status

vault operator init

Initializes Vault

vault login <initial_root_token_value>

Authenticates to Vault using a token

systemctl status vault

Displays the Vault service status

vault operator unseal

Unseals a Vault protected with a Shamir seal.

vault operator unseal -migrate

Migrates a Vault from a Shamir seal to a PKCS#11 seal.

vault read sys/license/status

Displays Vault license information.

vault secrets list

Lists enabled secrets engines.

vault secrets list -detailed

Displays detailed information about enabled secrets engines.

vault secrets enable -version=1 kv

Enables the KV secrets engine.

vault kv put kv/opt/vault/secret key=test_secret

Stores a sample secret in Vault.

vault kv get kv/opt/vault/secret

Retrieves a stored secret.

vault secrets enable -external-entropy-access transit

Enables the Transit engine with external entropy access.

vault write -f transit/keys/orders

Creates a new Transit encryption key.

vault write transit/encrypt/orders plaintext=<data>

Encrypts data using the Transit key.

vault write transit/decrypt/orders ciphertext=<ciphertext>

Decrypts data encrypted by Transit.

vault write sys/managed-keys/pkcs11/learn-managed-key ...

Creates a PKCS#11 managed key backed by the HSM.

vault read /sys/managed-keys/pkcs11/learn-managed-key

Displays details of the managed key.

vault write -force /sys/managed-keys/pkcs11/learn-managed-key/test/sign

Tests signing operations with the managed key.

vault secrets enable pki

Enables the PKI secrets engine.

vault secrets tune -allowed-managed-keys=learn-managed-key pki

Grants the PKI engine access to the managed key.

vault write -field=certificate pki/root/generate/kms managed_key_name=learnmanaged-key ...

Generates an HSM-backed Root CA certificate.

vault write pki/config/urls ...

Configures issuing certificate and CRL URLs.

vault write pki/roles/example-dot-com ...

Creates a PKI role for certificate issuance.

vault write -format=json pki/issue/example-dot-com common_name="test.example.com"

Issues a certificate signed by the HSM-backed CA.

systemctl enable vault.service

Enables the Vault service at boot.

systemctl start vault.service

Starts the Vault service.

systemctl stop vault.service

Stops the Vault service.

systemctl restart vault.service

Restarts the Vault service.

p11tool2 Slot=<slot> InitToken=<SO_PIN>

Initializes an HSM token.

p11tool2 LoginSO=<SO_PIN> InitPin=<User_PIN>

Initializes the slot user PIN.

p11tool2 ListObjects

Lists objects stored in an HSM slot.

base64 --decode <<< <plaintext>

Decodes a Base64-encoded value.