how can i bulk remove expired certificates from Vault

user_9738997 0
Viewed 2015

our vault storage keep cluttering up with massive amount of expired certificates.

there is an option to revoke a certificate using api or a lease id, but they are still available and can be queried.

following will only revoke a certificate,

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/pki/revoke

is there a way to permanently remove expired certificates?

hashicorp-vault
2 Answers

there is an endpoint for it,

tidy

This endpoint allows tidying up the storage backend and/or CRL by removing certificates that have expired and are past a certain buffer period beyond their expiration time.

So to remove all expired certificates make a POST request to https://<vault-api-url>:<api-port>/v1/<pki-role>/tidy with "tidy_cert_store": true as payload,

using cURL,

curl -X POST \
  https://<vault-api-url>:<api-port>/v1/<pki-role>/tidy \
  -H 'content-type: application/json' \
  -H 'x-vault-token: c32165c4-212f-2dc2e-cd9f-acf63bdce91c' \
  -d '{
    "tidy_cert_store": true
}'
user_11494230

The syntax Sufiyan provided appears incorrect (or for an old version). In Vault >1.2 (and maybe earlier) it should be:

curl -X POST \
  -H "X-Vault-Token: $VAULT_TOKEN" \
  -d '{"tidy_cert_store":true}' \
  $VAULT_ADDR/v1/pki/tidy

Which should result in the tidy process to begin, and return this response:

{
  "request_id": "",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": null,
  "wrap_info": null,
  "warnings": [
    "Tidy operation successfully started. Any information from the operation will be printed to Vault's server logs."
  ],
  "auth": null
}

Latest docs on Tidy are https://www.vaultproject.io/api/secret/pki/index.html#tidy

user_11440490
Related