Automate certificates with Vault Agent and TPM auth attestation

Vault Agent can do TPM-based attestation to ask Vault to generate an x509 certificate without manual operator intervention.

Requirements

• Vault Enterprise v2.2.0 or later
• A Vault TPM auth mount
• The local TPM must be enrolled in Vault's identity secret engine
• The TPM must either be included in the auth mount role's tpm_ids field or be part of a group included in the role's tpmgroup_ids field.

Configuration

Add a tpm_cert stanza to your Agent configuration file. Each block must have a unique label that you reference in an auto_auth tpm method.

Minimal example

vault {
  address = "https://vault.example.com:8200"
}

auto_auth {
    method "tpm" {
        mount_path = "auth/tpm"
        config = {
            tpm_cert      = "machine"
            reload        = true
            reload_period = "30s"
        }
    }

    sink "file" {
        config = {
            path = "/private/vault-token"
        }
    }
}

tpm_cert "machine" {
    mount_path = "auth/tpm"
    role_name  = "myrole"

    destination {
        path  = "/private/certs"
    }
}

Full example

tpm_cert "machine" {
    mount_path = "auth/tpm"
    role_name  = "myrole"

    renew {
        percent_renew_before_expiry = 20
    }

    tpm {
        device_path = "/dev/tpmrm0"
    }

    destination {
        path  = "/private/certs"
        umask = "077"
    }

    csr {
        CN  = "api.internal.example.com"
        C   = "US"
        ST  = "California"
        L   = "San Francisco"
        O   = "Example Corp"
        OU  = "Engineering"
    }
}

tpm_cert stanza reference

destination block

csr block

renew block

tpm block

Considerations

• Destination path values must be unique and must point to existing directories. Agent does not create them.
• The default umask of 077 means only the agent process owner can read the written key files.
• percent_renew_before_expiry is evaluated against the remaining TTL of the certificate. A value of 20 triggers renewal when 20% of the certificate's lifetime remains.