KV Secret
Configure KV Secret to receive renewed certificates automatically.
1. Overview
A HashiCorp Vault - KV Secret node deploys certificates to this configured target.
2. Configuration
Select this platform and deployment position, then supply the following parameters.
| Field | Required | Description |
|---|---|---|
| API URL | Yes | https://vault.example.com |
| API Token | Yes | |
| KV Mount | Yes | secret |
| Secret Path | Yes | certificates/example.com |
| KV Engine Version | Yes | KV v1 / KV v2; default: 2 |
| Vault Namespace | No | |
| Verify TLS Certificate | Yes | Yes (recommended) / No (self-signed server certificate); default: true |
3. Deployment and renewal
- Grant create and update permissions at this exact secret path. Writes cert (full chain) and key together. The token must remain valid for scheduled renewal; this node does not renew the token. This stores certificate material; consuming services must reload it themselves.
Associate the certificate with the node and enable automatic deployment on renewal. Certificate replacement uses the same configured target on every run.
The endpoint must use HTTPS and be reachable from the CertOne deployment service. TLS certificate verification is enabled by default. Disable verification only when the target has a self-signed certificate and its address is trusted.
KV v1 writes {cert, key} to /v1/<mount>/<path>. KV v2 writes {data: {cert, key}} to /v1/<mount>/data/<path>. The exact path is overwritten, so use a dedicated secret for this certificate. This is certificate storage, not activation on a web server.
Use a dedicated secret path: CertOne atomically writes the fields cert (full chain) and key (private key), replacing fields at that path. This is a single-secret layout and differs from the separate per-file secrets written by the acme.sh hook.
4. Verification
Automated protocol tests cover request construction, failure handling and credential redaction. This integration has not been tested against a live account or device in this change. A successful configuration check verifies connectivity and read access; the first deployment also verifies write permissions.