It is possible to force that multiple keys have to be entered in order to unseal the vault. How does this work in practice? If someone has entered a key and there is another key required to unseal the vault should one ask a colleague to enter another key and how should this be done to prevent that colleague A or someone else sees that key?


I assume your vault would be being accessed over a network, so you would ask a colleague to use their own command line on their own workstation to enter their key. Mine requires 3 keys to unseal so I just have 3 users independently enter the vault unseal command with their key.


I agree with @alitheg answer, and to add two my cents, sequence of commands to be executed by you or any 3 colleagues of yours who has possession of the vault unseal token

export VAULT_ADDR=https://vault.yourcompany.com  # Address of your Vault
export VAULT_SKIP_VERIFY=true                    # this can be skipped, if you use a proper certificate and not self-signed certificate
vault status                                     # to check the vault status
vault unseal                                     # this will ask for the vault unseal token

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.