https://www.problemofnetwork.com/tags/pki/ Recent content in Pki on Problem of Network Hugo en-gb Sat, 10 Oct 2026 23:30:00 +0200 https://www.problemofnetwork.com/posts/securing-vault-logins-with-client-certificates/ Sat, 10 Oct 2026 23:30:00 +0200 https://www.problemofnetwork.com/posts/securing-vault-logins-with-client-certificates/ <p>In the <a href="https://www.problemofnetwork.com/posts/securing-your-vault-instance-with-tls/">last post</a> we put a certificate from an offline certstrap CA on the Vault listener, so clients can check that Vault really is Vault. This one is the other half, and the last post in the Vault series: using certificates the other way round, to prove who <em>you</em> are, with the private key sitting on a YubiKey.</p> <p>Vault&rsquo;s <code>cert</code> auth method lets a client present a TLS client certificate instead of a password or a token, and Vault turns that into a short-lived token with a policy attached. The user-facing half of this is done with <a href="https://github.com/fatred/yubivault">yubivault</a>, a small tool that logs in to Vault with a client certificate and prints a token. This post is the &ldquo;why and how it fits together&rdquo; version of the <a href="https://github.com/fatred/yubivault/blob/main/PKI-SETUP.md">PKI-SETUP.md</a> guide in that repo.</p>