Hashicorp Vault

Note

Using a HSM with Hashicorp Vault requires an enterprise license for Vault! If your main use case is (automatic) unsealing with NetHSM, OpenBao also supports that.

HSM support

NetHSM can be used to protect your Vault secrets. It supports all features outlined in the Vault HSM overview through the NetHSM PKCS#11 module. This includes:

• Root key Wrapping

• Automatic Unsealing

• Seal Wrapping

• Entropy Augmentation

Please refer to the example setup and documentation for using Vault with NetHSM.

Managed Keys

Vault can also be configured to use NetHSM for 3rd party key management. This feature is also provided through PKCS#11 and is enabled by setting up NetHSM as kms_library in Vault.

Note

Utilizing managed keys though NetHSM has not been extensively tested. For a basic example, please refer to the setup documentation.