Example prompt: Set up a PKI certificate authority

Beta feature

Beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features in production deployments of Vault.

Use your AI agent to create a complete PKI infrastructure for SSL/TLS certificates.

Assumptions

You have a running HashiCorp Vault instance.
You have the Vault MCP server running.
You have a valid Vault authentication token with appropriate permissions for the resource you want to modify.
You have a local MCP client configured (e.g., Claude for Desktop, VS Code).

Prompt

I need to set up a PKI certificate authority for my internal 
services. Create a root CA for "example.com" and configure 
a role that can issue certificates for subdomains.

Expected workflow

The MCP server performs multiple coordinated operations:

Enable PKI mount: Creates a new PKI secrets engine
Create root issuer: Generates the root certificate authority
Create PKI role: Configures certificate issuance policies
Issue certificate: Generates a certificate for validation

Associated API request objects

Request object to create the pki mount:

{
  "path": "pki_root",
  "description": "Root CA for example.com internal services",
  "max_ttl": "87600h"
}

Request object to create the root issuer:

{
  "mount": "pki_root",
  "type": "internal", 
  "common_name": "example.com Root CA",
  "issuer_name": "example-root-ca",
  "ttl": "87600h"
}

Request object to create the PKI role:

{
  "mount": "pki_root",
  "role_name": "subdomain-role",
  "allowed_domains": "example.com",
  "allow_subdomains": true,
  "allow_bare_domains": false,
  "max_ttl": "8760h"
}

Sample response

Disclaimer

Example responses come from using the Vault MCP server with ChatGPT 4.1 in GitHub Copilot on VS Code. Your responses may vary.

Successfully configured PKI infrastructure for example.com:

## Root Certificate Authority
- **Mount Path**: `pki_root/`
- **Issuer Name**: `example-root-ca` 
- **Common Name**: `example.com Root CA`
- **Validity Period**: 10 years (87600h)

## Certificate Role Configuration
- **Role Name**: `subdomain-role`
- **Allowed Domains**: `example.com`
- **Subdomain Support**: ✅ Enabled
- **Max Certificate TTL**: 1 year (8760h)
- **Usage Flags**: Server & Client Authentication

## Next Steps
You can now issue certificates using:
vault write pki_root/issue/subdomain-role \
  common_name="api.example.com" \
  ttl="720h"

## Certificate Validation
The PKI infrastructure is ready to issue certificates for:
- `*.example.com` (subdomains)
- Custom TTL up to 1 year
- Both server and client authentication use cases