Vault PKI Certificate Management for TaskFlow
Stand up a private certificate authority inside Vault and use it to put the real TaskFlow backend on HTTPS, then rotate and revoke its certificate with a real client trust check.
Lab Overview
🛠Lab from the Platform Engineering Bootcamp. Used in Week 18. Bootcamp landing page: https://academy.tekanaid.com/bootcamps/platform-engineering-bootcamp Parent course(s):
- Week 18: Secrets Management with HashiCorp Vault (slug: secrets-management-vault)
Lab is part of the running TaskFlow project that grows across all 21 weeks of the bootcamp: the real TaskFlow backend is built and deployed here, and you secure it end to end with a Vault-issued certificate.
Build a two-tier private PKI inside Vault (self-signed root CA, signed intermediate CA, constrained issuing role), then issue a certificate for the real TaskFlow backend's Service DNS name and switch the running app to HTTPS. You verify with a real curl that trusts only your Vault CA, rotate the certificate into the live backend, revoke the old one, and prove the revoked certificate is rejected by an OpenSSL CRL check.
What You'll Learn
Enable and tune the Vault PKI secrets engine and generate a self-signed root certificate authority
Generate an intermediate CA CSR, sign it with the root CA, and import the signed intermediate to form a trust chain
Author a PKI role with allowed_domains, allow_subdomains, key constraints, and TTL limits scoped to backend.taskflow.svc.cluster.local
Issue a leaf certificate, mount it as a Kubernetes TLS secret, and switch the live TaskFlow backend to HTTPS verified with a Vault-only CA bundle
Rotate the certificate into the running backend, revoke the old one by serial, publish the CRL, and prove the revoked cert fails an OpenSSL CRL check
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Bootcamp participation
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Lab AI Assistant
- Accelerator bootcamps with live office hours
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now