3 ms·
We use Vault Enterprise at my company, and I do a lot of the deployment/adminsitration of vault. The enterprise version supports PKCS11 and external HSM: https:
by Daegalus 7y ago
We use Vault Enterprise at my company, and I do a lot of the deployment/adminsitration of vault. The enterprise version supports PKCS11 and external HSM: https://www.vaultproject.io/docs/configuration/seal/pkcs11.html https://www.vaultproject.io/docs/configuration/seal/pkcs11.h... and https://www.vaultproject.io/docs/configuration/entropy-augmentation/index.html https://www.vaultproject.io/docs/configuration/entropy-augme... for reference.
https://learn.hashicorp.com/vault/operations/ops-seal-wrap https://learn.hashicorp.com/vault/operations/ops-seal-wrap is a guide linked at the bottom
- weitzj 7y agoThanks. So to fully understand this - if I use seal wrapping with an HSM all secrets in Vault will be wrapped by the HSM and not only the masterkey/autounseal? And even though the rest is then in software (Vault) I still have the same FIPS level as the HSM?