Fail to deploy cert to HCP Vault

jfeng · March 9, 2023, 11:06pm

I have tried the task to deploy certificate to HashiCrop Cloud (HCP) version of Vault. It doesn’t work. I think it’s related to HCP vault uses namespace “admin” by default.

Is there undergoing development work to fix the issue and make Certify works with HCP Vault ?

webprofusion · March 10, 2023, 4:59am

You’re the first person to report a problem with the Hashicorp vault deployment task so I’m guessing you could be the first to use ti with the cloud version rather than a locally hosted version (which is what this was built with). Note that you can of course use a Powershell scripting task etc to run your own commands rather than relying on our built-in task.

Here’s the code that runs to push a cert to a vault:

github.com

webprofusion/certify-plugins/blob/development/src/DeploymentTasks/Core/Providers/HashicorpVault.cs#L62


      
          if (string.IsNullOrEmpty(managedCert.CertificatePath))
          {
              results.Add(new ActionResult("No certificate to deploy.", false));
              return results;
          
          
}
          string vaultUri = execParams.Settings.Parameters.FirstOrDefault(c => c.Key == "vault_uri")?.Value;
          string vaultPath = execParams.Settings.Parameters.FirstOrDefault(c => c.Key == "vault_secret_path")?.Value;
          
          
var httpClient = new HttpClient();
          httpClient.DefaultRequestHeaders.Add("X-Vault-Token", execParams.Credentials["api_token"]);
          httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
          
          
var vaultUrl = $"{vaultUri}{vaultPath}";
          
          
byte[] pfxData = File.ReadAllBytes(managedCert.CertificatePath);
          
          
var pfxPwd = "";
          
          
var secret = new
          {

webprofusion · March 10, 2023, 7:47am

It looks like we can either modify the task to allow you to specify an optional namespace which we then pass an http header, or the simplest/quickest alternative is you can specify the vault secret path with the namespace as a prefix e.g. instead of /secret/data/mycert you could use /namespace/secret/data/mycert