1

I am trying to set up a Hashicorp Vault server and have ran into some more road blocks. I can not get it so that I can write/read data either locally or through a domain name (I know the risks of have it available to the web and for this/testing it is fine).

Error message:

Error writing data to secret/keys: Put http://localhost/v1/secret/keys: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"

Here is my config files:

/etc/vault.hcl

backend "file" {
        path = "/var/lib/vault"
        address = "127.0.0.1:8200"
        scheme = "http"
        redirect_addr = "http://mydomain.com:8200"
        VAULT_ADDR = "http://mydomain.com:8200"
}

listener "tcp" {
        address = "http://mydomain.com"
        tls_disable = 0
        tls_cert_file = "/etc/letsencrypt/live/mydomain/fullchain.pem"
        tls_key_file = "/etc/letsencrypt/live/mydomain/privkey.pem"

}

/etc/systemd/system/vault.service

[Unit]
Description=a tool for managing secrets
Documentation=https://vaultproject.io/docs/
After=network.target
ConditionFileNotEmpty=/etc/vault.hcl

[Service]
User=vault
Group=vault
ExecStart=/usr/local/bin/vault server -config=/etc/vault.hcl
ExecReload=/usr/local/bin/kill --signal HUP $MAINPID
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
SecureBits=keep-caps
NoNewPrivileges=yes
KillSignal=SIGINT

[Install]
WantedBy=multi-user.target

Some other configuration:

VAULT_ADDR=http://mydomain.com

Some additional info:

I used the command sudo vault operator unseal -tls-skip-verify because I could not get it to work over HTTPS

Command I used to configure the server vault server -config=/etc/vault.hcl

1

You have your VAULT_ADDR set to HTTP, but vault is listening on TLS - the error you are receiving is the HTTP request receiving a TLS handshake.

Try changing VAULT_ADDR to https://mydomain.com.

  • That doesn't work, I get this error now Error checking seal status: Get https://mydomain.com/v1/sys/seal-status: dial tcp 127.0.0.1:443: connect: connection refused So now I don't even have a connection. – Josh Kirby Jul 6 '18 at 12:17
0

The set of errors are same that we have observed during TLS integration in Vault.

As stated by @Colin, change VAULT_ADDR to HTTPS, VAULT_ADDR=https://mydomain.com

Along with that change listener tcp address in vault.hcl as follows:

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = 0
  tls_cert_file = "***"
  tls_key_file = "***"
}

Hope this works for you as well!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.