I've been looking into Hashicorp Vault to use in my linux environment. Ive installed a certificate/private key pair on the Vault Server and told Vault to use TLS. It seems to be working correctly. I have a few questions:

  1. Would you classify Vault as a HTTP web server?

  2. What cipher suites does Vault use by default?

  3. How can I disable various cipher suites on both the Vault Server and Vault client? Can I use mod_ssl? or openssl?

  • 2
    What have you done to try to answer these questions yourself before asking us? Please edit your question to show evidence of prior research. – a CVn Nov 23 '16 at 12:55

Yes, the Vault server exposes an HTTP API. It can be run either with or without TLS.

There is a configuration option for specifying the allowed versions of TLS for the server, but not the specific cipher suites. This has been requested. It appears Vault uses Go's default cipher suite list.

The Vault cli client likely does the same thing. However, for most usage you'll use a library specific to your language, and the details of how that library implements the TLS connection are up to it.

If you find it necessary to have more control over the cipher suites exposed by the server, you can set up a TLS terminator (such as Nginx or HAProxy) that will handle the connection to clients, then forward requests from there to the Vault server (potentially again via HTTPS).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.