VAULT-ASSOCIATE-002 · Question #30
Which Vault secret engine may be used to build your own internal certificate authority?
The correct answer is B. PKI. The PKI (Public Key Infrastructure) secrets engine in Vault is specifically designed to function as a certificate authority, capable of generating, signing, and revoking X.509 certificates.
Question
Options
- ATransit
- BPKI
- CPostgreSQL
- DGeneric
How the community answered
(64 responses)- A2% (1)
- B91% (58)
- C3% (2)
- D5% (3)
Why each option
The PKI (Public Key Infrastructure) secrets engine in Vault is specifically designed to function as a certificate authority, capable of generating, signing, and revoking X.509 certificates.
The Transit secrets engine is used for cryptographic functions like encryption, decryption, and signing of arbitrary data, but it does not manage X.509 certificates or function as a CA.
The PKI secrets engine allows Vault to act as a certificate authority (CA), enabling it to generate new certificates, sign CSRs (Certificate Signing Requests), and manage certificate revocation lists (CRLs) or provide OCSP (Online Certificate Status Protocol) responses, making it ideal for managing internal TLS/SSL certificates.
The PostgreSQL secrets engine dynamically generates database credentials for PostgreSQL databases, not X.509 certificates.
The Generic secrets engine (KV secrets engine) is for storing arbitrary static secrets; it does not have the built-in functionality to operate as a CA.
Concept tested: Vault PKI secrets engine purpose
Source: https://developer.hashicorp.com/vault/docs/secrets/pki
Topics
Community Discussion
No community discussion yet for this question.