Example prompt: Issue SSL certificates for applications

Beta feature

Beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features in production deployments of Vault.

Use the following example as a guide to help you write your own prompt to handle certificate lifecycle management.

Assumptions

You have a running HashiCorp Vault instance.
You have the Vault MCP server running.
You have a valid Vault authentication token with appropriate permissions for the resource you want to modify.
You have a local MCP client configured (e.g., Claude for Desktop, VS Code).
You have the pki plugin enabled.
You have at least one PKI role defined.

Prompt

Issue an SSL certificate for my web application at 
"api.internal.example.com" valid for 30 days using 
the existing PKI role.

Expected workflow

The MCP server performs the following operations:

Validate role: Confirms the PKI role exists and policies
Issue certificate: Generates new SSL certificate
Return artifacts: Provides certificate, private key, and chain

Associated API request objects

Request object to issue a new certificate:

{
  "mount": "pki_root",
  "role_name": "subdomain-role", 
  "common_name": "api.internal.example.com",
  "ttl": "720h",
  "format": "pem"
}

Sample response

Disclaimer

Example responses come from using the Vault MCP server with ChatGPT 4.1 in GitHub Copilot on VS Code. Your responses may vary.

Successfully issued SSL certificate for api.internal.example.com:

## Certificate Details
- **Common Name**: `api.internal.example.com`
- **Serial Number**: `39:d4:f7:2c:8a:1b:5e:9f`
- **Validity Period**: 30 days (720h)
- **Key Algorithm**: RSA 2048-bit
- **Signature**: SHA256-RSA

## Certificate Files
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAOT7Wq...
[Certificate content]
-----END CERTIFICATE-----

## Private Key  
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQ...
[Private key content - handle securely]  
-----END PRIVATE KEY-----

## Certificate Chain
-----BEGIN CERTIFICATE-----
[Intermediate CA certificate]
-----END CERTIFICATE-----

## Installation Instructions
1. Save certificate to: `/etc/ssl/certs/api.internal.example.com.crt`
2. Save private key to: `/etc/ssl/private/api.internal.example.com.key` 
3. Set secure permissions: `chmod 600 /etc/ssl/private/*.key`
4. Update web server configuration to use new certificate
5. Restart web server to apply changes

**Security**: Store private key securely and never share it. 
Certificate expires in 30 days - set up renewal automation.