>_SecOpsLog_
BlogSecrets

Short-lived TLS certificates from Vault PKI

Run an internal CA in Vault and issue certs that live for hours, not years — rotation becomes a non-event.

Nov 4, 2025·11 min readAdvanced

Long-lived TLS certificates are a liability: they leak, they expire at the worst time, and rotating them is a project. Run Vault as an internal CA and issue certificates that live for hours. Rotation stops being an event because everything already re-fetches constantly.

Mount the PKI engine

bash
vault secrets enable pki
vault secrets tune -max-lease-ttl=87600h pki
vault write pki/root/generate/internal \
  common_name="Acme Internal CA" ttl=87600h

A role with a short max TTL

bash
vault write pki/roles/internal \
  allowed_domains="svc.acme.internal" \
  allow_subdomains=true \
  max_ttl=24h

Issue a certificate

bash — a 1-hour certlive
vault write pki/issue/internal common_name=api.svc.acme.internal ttl=1h
certificate -----BEGIN CERTIFICATE-----
private_key -----BEGIN PRIVATE KEY-----
expiration in 1 hour — fetched fresh, no rotation drama
Short TTL is the security
A stolen 1-hour cert is worthless within the hour. Pair with Vault Agent or cert-manager (vault issuer) so workloads renew automatically.
Go deeper in a courseVault from dev to productionPKI, dynamic secrets, auth methods and rotation, hands-on.View course

Related posts

Vault Kubernetes auth: secrets without static tokensJun 9, 2026 · 12 minDynamic database credentials for Jenkins with VaultMar 24, 2026 · 11 minEncrypt secrets in Git with SOPS and ageMar 3, 2026 · 8 min