hashicorp Vault : " Error initializing listener of type tcp: error loading TLS cert " Where is my mistake?

Viewed 2862

I try to run Vault with docker-compose on Virtual machine ubuntu 20.04 ( ip : 192.168.56.9 ). Without the https, already works fine, but when I try to put vault in https with self-signed certificat from openssl, it doesn't works.

Here my configurations :

docker-compose.yml :

version: '3.6'

services:

  vault:
    build:
      context: ./vault
      dockerfile: Dockerfile
    ports:
      - 8200:8200
    volumes:
      - ./vault/config:/vault/config
      - ./vault/policies:/vault/policies
      - ./vault/data:/vault/data
      - ./vault/logs:/vault/logs
      - ./vault/volume_test/:/vault/volume_test
    environment:
      - VAULT_ADDR=http://192.168.56.9:8200
    command: server -config=/vault/config/vault-config.conf
    cap_add:
      - IPC_LOCK

Dockerfile :

# base image
FROM alpine:3.7

# set vault version
ENV VAULT_VERSION 0.10.3

# create a new directory
RUN mkdir /vault

# download dependencies
RUN apk --no-cache add \
      bash \
      ca-certificates \
      wget

# download and set up vault
RUN wget --quiet --output-document=/tmp/vault.zip https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip && \
    unzip /tmp/vault.zip -d /vault && \
    rm -f /tmp/vault.zip && \
    chmod +x /vault

# update PATH
ENV PATH="PATH=$PATH:$PWD/vault"

# add the config file
COPY ./config/vault-config.conf /vault/config/vault-config.conf

# expose port 8200
EXPOSE 8200

# run vault
ENTRYPOINT ["vault"]

My vault-config.conf :

backend "file" {
  path = "vault/data"
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = false
  tls_cert_file = "/home/xxx/Vault-Docker/domain.crt"
  tls_key_file = "/home/xxx/Vault-Docker/domain.key"
}

#api_addr = "http://192.168.56.9:8200"

disable_mlock = true

ui = true

How I create my .crt and my .key :

Create a cert.conf file in /home/xxx/Vault-Docker/ :

[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = FR
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = 192.168.56.9

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.56.9

And excute in /home/xxx/Vault-Docker/ :

openssl req -nodes -x509 -days 365 -keyout domain.key -out domain.crt -config cert.conf

But when I run :

docker-compose up -d --build

Then :

docker logs vault-docker_vault_1 

The output is :

Error initializing listener of type tcp: error loading TLS cert: open /home/xxx/Vault-Docker/domain.crt: no such file or directory

Someone to tell me where is my error ?

Thanks a lot !

2 Answers

That's because your cert configuration is not mounted inside the container. In order to fix it, you need to:

  1. create a new directory ./vault/cert
  2. move both domain.crt and domain.key to ./vault/cert
  3. add to docker-compose-yml a new volume:
   volumes:
...
     - ./vault/cert/:/vault/cert
...
  1. Change on vault-config.conf from /home/.../domain* to /vault/cert/domain* on both tls_cert_* directives



Then Vault will be able to find the certificates.

You are giving the certificate path which will be the container path and you have kept the certificate in the host machine.

Related