Hashicorp vault not writing out KV

Question

I am trying to set up a Hashicorp Vault server and have ran into some more road blocks. I can not get it so that I can write/read data either locally or through a domain name (I know the risks of have it available to the web and for this/testing it is fine).

Error message:

Error writing data to secret/keys: Put http://localhost/v1/secret/keys: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"

Here is my config files:

/etc/vault.hcl

backend "file" {
        path = "/var/lib/vault"
        address = "127.0.0.1:8200"
        scheme = "http"
        redirect_addr = "http://mydomain.com:8200"
        VAULT_ADDR = "http://mydomain.com:8200"
}

listener "tcp" {
        address = "http://mydomain.com"
        tls_disable = 0
        tls_cert_file = "/etc/letsencrypt/live/mydomain/fullchain.pem"
        tls_key_file = "/etc/letsencrypt/live/mydomain/privkey.pem"

}

---

/etc/systemd/system/vault.service

[Unit]
Description=a tool for managing secrets
Documentation=https://vaultproject.io/docs/
After=network.target
ConditionFileNotEmpty=/etc/vault.hcl

[Service]
User=vault
Group=vault
ExecStart=/usr/local/bin/vault server -config=/etc/vault.hcl
ExecReload=/usr/local/bin/kill --signal HUP $MAINPID
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
SecureBits=keep-caps
NoNewPrivileges=yes
KillSignal=SIGINT

[Install]
WantedBy=multi-user.target

Some other configuration:

VAULT_ADDR=http://mydomain.com

Some additional info:

I used the command sudo vault operator unseal -tls-skip-verify because I could not get it to work over HTTPS

Command I used to configure the server vault server -config=/etc/vault.hcl

Answer 1

You have your VAULT_ADDR set to HTTP, but vault is listening on TLS - the error you are receiving is the HTTP request receiving a TLS handshake.

Try changing VAULT_ADDR to https://mydomain.com.

Answer 2

The set of errors are same that we have observed during TLS integration in Vault.

As stated by @Colin, change VAULT_ADDR to HTTPS, VAULT_ADDR=https://mydomain.com

Along with that change listener tcp address in vault.hcl as follows:

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = 0
  tls_cert_file = "***"
  tls_key_file = "***"
}

Hope this works for you as well!