0

I am getting the below error when I go to read or do anything with a Hashicorp Vault. It doesn't want to work at all. I had it working locally last week and nothing I know of has changed other than the day of the week.

The SSL cert was not working last week either but I did --no-tls or similar (can't find the command right now).

I want to be able to connect and read a secret via curl using the API and a DNS record.

Any idea what is happening that I now can not access anything?

Error:

Error checking seal status: Get https://127.0.0.1:8200/v1/sys/seal-status: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs

/etc.vault.hcl

backend "file" {
        path = "/var/lib/vault"
        scheme = "http"
        redirect_addr = "http://domain.com:8200"
        VAULT_ADDR = "http://damain.com:8200"
}

listener "tcp" {
        address = "http://doamin.com"
        tls_disable = 0
        tls_cert_file = "/etc/letsencrypt/live/domain.com/fullchain.pem"
        tls_key_file = "/etc/letsencrypt/live/domain.com/privkey.pem"

}
0

This error is because Vault is not able to validate the certificate with name "127.0.0.1".

SAN stands for Subject Alternative Name, field which lets you specify additional host names (IP address, common names ) to be protected by single certificate. For reference I have added SAN info for stackexchange.

enter image description here

So the issue is because you have configured the environment variable VAULT_ADDR as https://127.0.0.1, Vault is not able to validate the SAN configured as per the certificate provided by you. So provide the names that are configured as part of SAN in your certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.