Configuring a CA Policy for HashiCorp Vault CA

Before You Begin

  • Certificate Group(s) must be available to map the Policy to them.
  • CA accounts (settings) must be available to which the policy is going to be created.
  • Key Algorithm, Encryption Type must be available under the CA accounts.
  • AppViewX permission required (Accounts > Roles - Click here to check Accounts management).

To configure a Hashicorp Vault CA policy:

  1. Go to (Menu) > CERT+ > GROUPS & POLICIES > CA Policy.
    The CA Policy page is displayed with a list of policies and their associated groups.
    Note: A Default policy will always be present in the list. Most of the roles are mapped to this policy. This policy can be used for any of the configured CAs.
  2. To create a custom policy, click +Create from the top-right corner of the CA Policy page.
    The CA Policy :: Create page is displayed.
  3. Refer the Configuring Policy Details section to configure the following:
    • Policy Details
    • Group Selection
    • Compliance Check
  4. In the CA Details section, from the Certificate Authority list in the left, select HashicorpVault.
    The CA Details section is updated to display fields relevant to HashicorpVault.
  5. Enter the CA details.
    Table 1. Field Description for CA Details
    Fields Description
    *CA Accounts Select a CA account from the list to create the policy.
    *Secret Engine The single-select dropdown contains all the secret engines associated with the account.

    In a secret engine, a role describes an identity with a set of permissions, groups, or policies you want to attach to a user of the secret engine. User identity is often mapped to a specific role. Hence, a single secret engine needs to be selected to populate role (below) specific to it.
    *Role The dropdown list contains all the roles mapped to the secret engine.
    *: Mandatory fields
  6. Click Add.
    The CA details are saved to the table and the confirmation message is displayed.

    Multiple values can be configured based on the available CA settings and secret engines with different bit length - key type and hash function. The supported values include:

    • Key Type: RSA, EC
    • Bit Length:
      • RSA key type: 2048 (default), 3072, or 4096
      • EC key type: 224, 256 (default), 384, or 521
    • Hash Function: SHA-256, SHA-384, SHA-512

    The CA Details table has options to View, Edit, and Delete.

    1. To view the CA details, click the View link in the View column. The CA account details are displayed in a pop-up window with the Bit Length - Key Type and Hash Function.
    2. To update the CA details, click the edit icon in the Edit column.
    3. To delete the CA details, click the delete icon.
  7. Enter the certificate parameters.
    Table 2. Field description for certificate parameters
    Fields Description
    Restrict Wild Card Certificate Slide toggle switch to the ON position to restrict the creation of wild card certificates using the policy.
    Host name Enter the host name.

    The host name cannot start and end with a . (period)
    *Allowed Domain Names Enter only the whitelisted domain names.

    Press enter after adding the domain name. Multiple domain names can be added.
    Common Name Enter the common name. For example, *.domain.com

    This enforces domains for which a certificate can be requested. The common name is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.

    Note: Use the * (asterisk) for the host part of the FQDN to enforce the domain. For example, *.domain.com will only allow users to request certificates with domain.com. Allowed special characters: *(Asterisk), - (hyphen), . (period).
    Organization Enter the organization name.

    The discovered certificate's subject organization will be compared against the organization provided in the policy to check for compliance. The organization is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Organization Unit Enter the organization unit. The discovered certificate's Subject Organization Unit will be compared against the organization unit provided in the policy to check for compliance. Organization Unit is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Locality Enter the locality name.

    The discovered certificate's locality will be compared against locality provided in the policy to check for compliance. The locality is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    State Enter the state.

    The discovered certificate's state will be compared against the state provided in the policy to check for compliance. The state is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Country code Enter the country code.

    The discovered certificate's country code will be compared against the country code provided in the policy to check for compliance. Country code is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Email Enter the email address of the organization unit.

    The discovered certificate's email address will be compared against the email address provided in the policy to check for compliance. The email address is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Subject Alternative Name Enter the subject alternative name (SAN). It helps enforce additional domains for which a certificate can be requested. The SAN is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Note: Use the * (asterisk) for the host part of the FQDN to enforce the domain. For example, *.domain.com will only allow users to request certificates with domain.com. Allowed special characters: *(Asterisk), - (hyphen), . (period).
    *: Mandatory fields
  8. Click Save CA Details.
    A green tick mark is displayed in the Certificate Authority pane against the Hashicorp Vault option to indicate that the details are successfully saved.
  9. In the Group Selection, select one or more groups to map to the policy. Refer to the Certificate Group section to add/update groups.
  10. Under the Compliance Check section, enable the Perform Compliance Check option to perform an immediate compliance check.
  11. Click Create Policy button.
    The policy is created and a confirmation message is displayed.