<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="keyring-hashicorp-plugin">
      </a>
      8.4.4.8 Using the HashiCorp Vault Keyring Plugin
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045240335696">
  </a>
  <a class="indexterm" name="idm46045240334656">
  </a>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    The
    <code class="literal">
     keyring_hashicorp
    </code>
    plugin is an
          extension included in MySQL Enterprise Edition, a commercial product. To learn
          more about commercial products, see
    <a class="ulink" href="https://www.mysql.com/products/" target="_blank">
     https://www.mysql.com/products/
    </a>
    .
   </p>
  </div>
  <p>
   The
   <code class="literal">
    keyring_hashicorp
   </code>
   keyring plugin
        communicates with HashiCorp Vault for back end storage. The
        plugin supports HashiCorp Vault AppRole authentication. No key
        information is permanently stored in MySQL server local storage.
        (An optional in-memory key cache may be used as intermediate
        storage.) Random key generation is performed on the MySQL server
        side, with the keys subsequently stored to Hashicorp Vault.
  </p>
  <p>
   The
   <code class="literal">
    keyring_hashicorp
   </code>
   plugin supports the
        functions that comprise the standard MySQL Keyring service
        interface. Keyring operations performed by those functions are
        accessible at two levels:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      SQL interface: In SQL statements, call the functions
            described in
      <a class="xref" href="keyring-functions-general-purpose.html" title="8.4.4.12 General-Purpose Keyring Key-Management Functions">
       Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      C interface: In C-language code, call the keyring service
            functions described in
      <a class="xref" href="keyring-service.html" title="7.6.9.2 The Keyring Service">
       Section 7.6.9.2, “The Keyring Service”
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   Example (using the SQL interface):
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa93769253"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> keyring_key_generate<span class="token punctuation">(</span><span class="token string">'MyKey'</span><span class="token punctuation">,</span> <span class="token string">'AES'</span><span class="token punctuation">,</span> <span class="token number">32</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> keyring_key_remove<span class="token punctuation">(</span><span class="token string">'MyKey'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   For information about the characteristics of key values
        permitted by
   <code class="literal">
    keyring_hashicorp
   </code>
   , see
   <a class="xref" href="keyring-key-types.html" title="8.4.4.10 Supported Keyring Key Types and Lengths">
    Section 8.4.4.10, “Supported Keyring Key Types and Lengths”
   </a>
   .
  </p>
  <p>
   To install
   <code class="literal">
    keyring_hashicorp
   </code>
   , use the general
        instructions found in
   <a class="xref" href="keyring-plugin-installation.html" title="8.4.4.3 Keyring Plugin Installation">
    Section 8.4.4.3, “Keyring Plugin Installation”
   </a>
   , together with the
        configuration information specific to
   <code class="literal">
    keyring_hashicorp
   </code>
   found here. Plugin-specific
        configuration includes preparation of the certificate and key
        files needed for connecting to HashiCorp Vault, as well as
        configuring HashiCorp Vault itself. The following sections
        provide the necessary instructions.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="keyring-hashicorp-plugin.html#keyring-hashicorp-certificate-configuration" title="Certificate and Key Preparation">
       Certificate and Key Preparation
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="keyring-hashicorp-plugin.html#keyring-hashicorp-vault-configuration" title="HashiCorp Vault Setup">
       HashiCorp Vault Setup
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="keyring-hashicorp-plugin.html#keyring-hashicorp-plugin-configuration" title="keyring_hashicorp Configuration">
       keyring_hashicorp Configuration
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="keyring-hashicorp-certificate-configuration">
       </a>
       Certificate and Key Preparation
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045240313408">
   </a>
   <p>
    The
    <code class="literal">
     keyring_hashicorp
    </code>
    plugin requires a
          secure connection to the HashiCorp Vault server, employing the
          HTTPS protocol. A typical setup includes a set of certificate
          and key files:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="filename">
        company.crt
       </code>
       : A custom CA certificate
              belonging to the organization. This file is used both by
              HashiCorp Vault server and the
       <code class="literal">
        keyring_hashicorp
       </code>
       plugin.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="filename">
        vault.key
       </code>
       : The private key of the
              HashiCorp Vault server instance. This file is used by
              HashiCorp Vault server.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="filename">
        vault.crt
       </code>
       : The certificate of the
              HashiCorp Vault server instance. This file must be signed
              by the organization CA certificate.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The following instructions describe how to create the
          certificate and key files using OpenSSL. (If you already have
          those files, proceed to
    <a class="xref" href="keyring-hashicorp-plugin.html#keyring-hashicorp-vault-configuration" title="HashiCorp Vault Setup">
     HashiCorp Vault Setup
    </a>
    .) The
          instructions as shown apply to Linux platforms and may require
          adjustment for other platforms.
   </p>
   <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Important
    </div>
    <p>
     Certificates generated by these instructions are
            self-signed, which may not be very secure. After you gain
            experience using such files, consider obtaining
            certificate/key material from a registered certificate
            authority.
    </p>
   </div>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Prepare the company and HashiCorp Vault server keys.
      </p>
      <p>
       Use the following commands to generate the key files:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa32393417"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl genrsa <span class="token property">-aes256</span> <span class="token property">-out</span> company<span class="token punctuation">.</span>key 4096
openssl genrsa <span class="token property">-aes256</span> <span class="token property">-out</span> vault<span class="token punctuation">.</span>key 2048</code></pre>
      </div>
      <p>
       The commands produce files holding the company private key
              (
       <code class="filename">
        company.key
       </code>
       ) and the Vault server
              private key (
       <code class="filename">
        vault.key
       </code>
       ). The keys are
              randomly generated RSA keys of 4,096 and 2,048 bits,
              respectively.
      </p>
      <p>
       Each command prompts for a password. For testing purposes,
              the password is not required. To disable it, omit the
       <code class="option">
        -aes256
       </code>
       argument.
      </p>
      <p>
       The key files hold sensitive information and should be
              stored in a secure location. The password (also sensitive)
              is required later, so write it down and store it in a
              secure location.
      </p>
      <p>
       (Optional) To check key file content and validity, use the
              following commands:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa20804115"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl rsa <span class="token property">-in</span> company<span class="token punctuation">.</span>key <span class="token property">-check</span>
openssl rsa <span class="token property">-in</span> vault<span class="token punctuation">.</span>key <span class="token property">-check</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Create the company CA certificate.
      </p>
      <p>
       Use the following command to create a company CA
              certificate file named
       <code class="filename">
        company.crt
       </code>
       that is valid for 365 days (enter the command on a single
              line):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa14056329"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl req <span class="token property">-x509</span> <span class="token property">-new</span> <span class="token property">-nodes</span> <span class="token property">-key</span> company<span class="token punctuation">.</span>key
  <span class="token property">-sha256</span> <span class="token property">-days</span> 365 <span class="token property">-out</span> company<span class="token punctuation">.</span>crt</code></pre>
      </div>
      <p>
       If you used the
       <code class="option">
        -aes256
       </code>
       argument to
              perform key encryption during key generation, you are
              prompted for the company key password during CA
              certificate creation. You are also prompted for
              information about the certificate holder (that is, you or
              your company), as shown here:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa26853721"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:</code></pre>
      </div>
      <p>
       Answer the prompts with appropriate values.
      </p>
     </li>
     <li class="listitem">
      <p>
       Create a certificate signing request.
      </p>
      <p>
       To create a HashiCorp Vault server certificate, a
              Certificate Signing Request (CSR) must be prepared for the
              newly created server key. Create a configuration file
              named
       <code class="filename">
        request.conf
       </code>
       containing the
              following lines. If the HashiCorp Vault server does not
              run on the local host, substitute appropriate CN and IP
              values, and make any other changes required.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa29029241"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[req]</span>
<span class="token constant">distinguished_name</span> <span class="token attr-value"><span class="token punctuation">=</span> vault</span>
<span class="token constant">x509_entensions</span> <span class="token attr-value"><span class="token punctuation">=</span> v3_req</span>
<span class="token constant">prompt</span> <span class="token attr-value"><span class="token punctuation">=</span> no</span>

<span class="token selector">[vault]</span>
<span class="token constant">C</span> <span class="token attr-value"><span class="token punctuation">=</span> US</span>
<span class="token constant">ST</span> <span class="token attr-value"><span class="token punctuation">=</span> CA</span>
<span class="token constant">L</span> <span class="token attr-value"><span class="token punctuation">=</span> RWC</span>
<span class="token constant">O</span> <span class="token attr-value"><span class="token punctuation">=</span> Company</span>
<span class="token constant">CN</span> <span class="token attr-value"><span class="token punctuation">=</span> 127.0.0.1</span>

<span class="token selector">[v3_req]</span>
<span class="token constant">subjectAltName</span> <span class="token attr-value"><span class="token punctuation">=</span> @alternatives</span>
<span class="token constant">authorityKeyIdentifier</span> <span class="token attr-value"><span class="token punctuation">=</span> keyid,issuer</span>
<span class="token constant">basicConstraints</span> <span class="token attr-value"><span class="token punctuation">=</span> CA:TRUE</span>

<span class="token selector">[alternatives]</span>
<span class="token constant">IP</span> <span class="token attr-value"><span class="token punctuation">=</span> 127.0.0.1</span></code></pre>
      </div>
      <p>
       Use this command to create the signing request:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa86606596"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl req <span class="token property">-new</span> <span class="token property">-key</span> vault<span class="token punctuation">.</span>key <span class="token property">-config</span> request<span class="token punctuation">.</span>conf <span class="token property">-out</span> request<span class="token punctuation">.</span>csr</code></pre>
      </div>
      <p>
       The output file (
       <code class="filename">
        request.csr
       </code>
       ) is an
              intermediate file that serves as input for creation of the
              server certificate.
      </p>
     </li>
     <li class="listitem">
      <p>
       Create the HashiCorp Vault server certificate.
      </p>
      <p>
       Sign the combined information from the HashiCorp Vault
              server key (
       <code class="filename">
        vault.key
       </code>
       ) and the CSR
              (
       <code class="filename">
        request.csr
       </code>
       ) with the company
              certificate (
       <code class="filename">
        company.crt
       </code>
       ) to create
              the HashiCorp Vault server certificate
              (
       <code class="filename">
        vault.crt
       </code>
       ). Use the following
              command to do this (enter the command on a single line):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa60115148"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl x509 <span class="token property">-req</span> <span class="token property">-in</span> request<span class="token punctuation">.</span>csr
  <span class="token property">-CA</span> company<span class="token punctuation">.</span>crt <span class="token property">-CAkey</span> company<span class="token punctuation">.</span>key <span class="token property">-CAcreateserial</span>
  <span class="token property">-out</span> vault<span class="token punctuation">.</span>crt <span class="token property">-days</span> 365 <span class="token property">-sha256</span></code></pre>
      </div>
      <p>
       To make the
       <code class="filename">
        vault.crt
       </code>
       server
              certificate useful, append the contents of the
       <code class="filename">
        company.crt
       </code>
       company certificate to
              it. This is required so that the company certificate is
              delivered along with the server certificate in requests.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa24595672"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">cat company<span class="token punctuation">.</span>crt &gt;&gt; vault<span class="token punctuation">.</span>crt</code></pre>
      </div>
      <p>
       If you display the contents of the
       <code class="filename">
        vault.crt
       </code>
       file, it should look like
              this:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa9323570"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">-----BEGIN CERTIFICATE-----
... <em class="replaceable">content of HashiCorp Vault server certificate</em> ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... <em class="replaceable">content of company certificate</em> ...
-----END CERTIFICATE-----</code></pre>
      </div>
     </li>
    </ol>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="keyring-hashicorp-vault-configuration">
       </a>
       HashiCorp Vault Setup
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045240268064">
   </a>
   <p>
    The following instructions describe how to create a HashiCorp
          Vault setup that facilitates testing the
    <code class="literal">
     keyring_hashicorp
    </code>
    plugin.
   </p>
   <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Important
    </div>
    <p>
     A test setup is similar to a production setup, but
            production use of HashiCorp Vault entails additional
            security considerations such as use of non-self-signed
            certificates and storing the company certificate in the
            system trust store. You must implement whatever additional
            security steps are needed to satisfy your operational
            requirements.
    </p>
   </div>
   <p>
    These instructions assume availability of the certificate and
          key files created in
    <a class="xref" href="keyring-hashicorp-plugin.html#keyring-hashicorp-certificate-configuration" title="Certificate and Key Preparation">
     Certificate and Key Preparation
    </a>
    .
          See that section if you do not have those files.
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Fetch the HashiCorp Vault binary.
      </p>
      <p>
       Download the HashiCorp Vault binary appropriate for your
              platform from
       <a class="ulink" href="https://www.vaultproject.io/downloads.html" target="_blank">
        https://www.vaultproject.io/downloads.html
       </a>
       .
      </p>
      <p>
       Extract the content of the archive to produce the
              executable
       <span class="command">
        <strong>
         vault
        </strong>
       </span>
       command, which is used
              to perform HashiCorp Vault operations. If necessary, add
              the directory where you install the command to the system
              path.
      </p>
      <p>
       (Optional) HashiCorp Vault supports autocomplete options
              that make it easier to use. For more information, see
       <a class="ulink" href="https://learn.hashicorp.com/vault/getting-started/install#command-completion" target="_blank">
        https://learn.hashicorp.com/vault/getting-started/install#command-completion
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Create the HashiCorp Vault server configuration file.
      </p>
      <p>
       Prepare a configuration file named
       <code class="filename">
        config.hcl
       </code>
       with the following
              content. For the
       <code class="literal">
        tls_cert_file
       </code>
       ,
       <code class="literal">
        tls_key_file
       </code>
       , and
       <code class="literal">
        path
       </code>
       values, substitute path names
              appropriate for your system.
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa4519787"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">listener "tcp" {
  address="127.0.0.1:8200"
  tls_cert_file="/home/username/certificates/vault.crt"
  tls_key_file="/home/username/certificates/vault.key"
}

storage "file" {
  path = "/home/username/vaultstorage/storage"
}

ui = true</code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Start the HashiCorp Vault server.
      </p>
      <p>
       To start the Vault server, use the following command,
              where the
       <code class="option">
        -config
       </code>
       option specifies the
              path to the configuration file just created:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa35596947"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault server <span class="token constant">-config</span><span class="token attr-value"><span class="token punctuation">=</span>config.hcl</span></code></pre>
      </div>
      <p>
       During this step, you may be prompted for a password for
              the Vault server private key stored in the
       <code class="filename">
        vault.key
       </code>
       file.
      </p>
      <p>
       The server should start, displaying some information on
              the console (IP, port, and so forth).
      </p>
      <p>
       So that you can enter the remaining commands, put the
       <span class="command">
        <strong>
         vault server
        </strong>
       </span>
       command in the background
              or open another terminal before continuing.
      </p>
     </li>
     <li class="listitem">
      <p>
       Initialize the HashiCorp Vault server.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The operations described in this step are required only
                when starting Vault the first time, to obtain the unseal
                key and root token. Subsequent Vault instance restarts
                require only unsealing using the unseal key.
       </p>
      </div>
      <p>
       Issue the following commands (assuming Bourne shell
              syntax):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa99720928"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">export VAULT_SKIP_VERIFY<span class="token attr-value"><span class="token punctuation">=</span>1</span>
vault operator init <span class="token property">-n</span> 1 <span class="token property">-t</span> 1</code></pre>
      </div>
      <p>
       The first command enables the
       <span class="command">
        <strong>
         vault
        </strong>
       </span>
       command to temporarily ignore the fact that no company
              certificate has been added to the system trust store. It
              compensates for the fact that our self-signed CA is not
              added to that store. (For production use, such a
              certificate should be added.)
      </p>
      <p>
       The second command creates a single unseal key with a
              requirement for a single unseal key to be present for
              unsealing. (For production use, an instance would have
              multiple unseal keys with up to that many keys required to
              be entered to unseal it. The unseal keys should be
              delivered to key custodians within the company. Use of a
              single key might be considered a security issue because
              that permits the vault to be unsealed by a single key
              custodian.)
      </p>
      <p>
       Vault should reply with information about the unseal key
              and root token, plus some additional text (the actual
              unseal key and root token values differ from those shown
              here):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa56263700"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">...
Unseal Key 1: I2xwcFQc892O0Nt2pBiRNlnkHzTUrWS+JybL39BjcOE=
Initial Root Token: s.vTvXeo3tPEYehfcd9WH7oUKz
...</code></pre>
      </div>
      <p>
       Store the unseal key and root token in a secure location.
      </p>
     </li>
     <li class="listitem">
      <p>
       Unseal the HashiCorp Vault server.
      </p>
      <p>
       Use this command to unseal the Vault server:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa87158891"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault operator unseal</code></pre>
      </div>
      <p>
       When prompted to enter the unseal key, use the key
              obtained previously during Vault initialization.
      </p>
      <p>
       Vault should produce output indicating that setup is
              complete and the vault is unsealed.
      </p>
     </li>
     <li class="listitem">
      <p>
       Log in to the HashiCorp Vault server and verify its
              status.
      </p>
      <p>
       Prepare the environment variables required for logging in
              as root:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa43660810"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault login s<span class="token punctuation">.</span>vTvXeo3tPEYehfcd9WH7oUKz</code></pre>
      </div>
      <p>
       For the token value in that command, substitute the
              content of the root token obtained previously during Vault
              initialization.
      </p>
      <p>
       Verify the Vault server status:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa29371667"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault status</code></pre>
      </div>
      <p>
       The output should contain these lines (among others):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa63398"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">...
Initialized     true
Sealed          false
...</code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Set up HashiCorp Vault authentication and storage.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The operations described in this step are needed only
                the first time the Vault instance is run. They need not
                be repeated afterward.
       </p>
      </div>
      <p>
       Enable the AppRole authentication method and verify that
              it is in the authentication method list:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa29412282"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault auth enable approle
vault auth list</code></pre>
      </div>
      <p>
       Enable the Vault KeyValue storage engine:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa8485203"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault secrets enable <span class="token constant">-version</span><span class="token attr-value"><span class="token punctuation">=</span>1</span> kv</code></pre>
      </div>
      <p>
       Create and set up a role for use with the
       <code class="literal">
        keyring_hashicorp
       </code>
       plugin (enter the
              command on a single line):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa13099533"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault write auth/approle/role/mysql token_num_uses<span class="token attr-value"><span class="token punctuation">=</span>0</span>
  token_ttl<span class="token attr-value"><span class="token punctuation">=</span>20m</span> token_max_ttl<span class="token attr-value"><span class="token punctuation">=</span>30m</span> secret_id_num_uses<span class="token attr-value"><span class="token punctuation">=</span>0</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Add an AppRole security policy.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The operations described in this step are needed only
                the first time the Vault instance is run. They need not
                be repeated afterward.
       </p>
      </div>
      <p>
       Prepare a policy that to permit the previously created
              role to access appropriate secrets. Create a new file
              named
       <code class="filename">
        mysql.hcl
       </code>
       with the following
              content:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa46387417"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">path "kv/mysql/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}</code></pre>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        <code class="filename">
         kv/mysql/
        </code>
        in this example may need
                adjustment per your local installation policies and
                security requirements. If so, make the same adjustment
                wherever else
        <code class="filename">
         kv/mysql/
        </code>
        appears in
                these instructions.
       </p>
      </div>
      <p>
       Import the policy file to the Vault server to create a
              policy named
       <code class="literal">
        mysql-policy
       </code>
       , then assign
              the policy to the new role:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa95710739"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault policy write mysql-policy mysql<span class="token punctuation">.</span>hcl
vault write auth/approle/role/mysql policies<span class="token attr-value"><span class="token punctuation">=</span>mysql-policy</span></code></pre>
      </div>
      <p>
       Obtain the ID of the newly created role and store it in a
              secure location:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa52933181"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault read auth/approle/role/mysql/role-id</code></pre>
      </div>
      <p>
       Generate a secret ID for the role and store it in a secure
              location:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa28958157"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">vault write <span class="token property">-f</span> auth/approle/role/mysql/secret-id</code></pre>
      </div>
      <p>
       After these AppRole role ID and secret ID credentials are
              generated, they are expected to remain valid indefinitely.
              They need not be generated again and the
       <code class="literal">
        keyring_hashicorp
       </code>
       plugin can be
              configured with them for use on an ongoing basis. For more
              information about AuthRole authentication, visit
       <a class="ulink" href="https://www.vaultproject.io/docs/auth/approle.html" target="_blank">
        https://www.vaultproject.io/docs/auth/approle.html
       </a>
       .
      </p>
     </li>
    </ol>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="keyring-hashicorp-plugin-configuration">
       </a>
       keyring_hashicorp Configuration
      </h5>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045240206416">
   </a>
   <p>
    The plugin library file contains the
    <code class="literal">
     keyring_hashicorp
    </code>
    plugin and a loadable
          function,
    <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-hashicorp-update-config">
     <code class="literal">
      keyring_hashicorp_update_config()
     </code>
    </a>
    .
          When the plugin initializes and terminates, it automatically
          loads and unloads the function. There is no need to load and
          unload the function manually.
   </p>
   <p>
    The
    <code class="literal">
     keyring_hashicorp
    </code>
    plugin supports the
          configuration parameters shown in the following table. To
          specify these parameters, assign values to the corresponding
          system variables.
   </p>
   <div class="informaltable">
    <table summary="keyring_hashicorp configuration parameters and corresponding system variables.">
     <colgroup>
      <col style="width: 35%"/>
      <col style="width: 50%"/>
      <col style="width: 15%"/>
     </colgroup>
     <thead>
      <tr>
       <th scope="col">
        Configuration Parameter
       </th>
       <th scope="col">
        System Variable
       </th>
       <th scope="col">
        Mandatory
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <th scope="row">
        HashiCorp Server URL
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_server_url">
         <code class="literal">
          keyring_hashicorp_server_url
         </code>
        </a>
       </td>
       <td>
        No
       </td>
      </tr>
      <tr>
       <th scope="row">
        AppRole role ID
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_role_id">
         <code class="literal">
          keyring_hashicorp_role_id
         </code>
        </a>
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        AppRole secret ID
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_secret_id">
         <code class="literal">
          keyring_hashicorp_secret_id
         </code>
        </a>
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        Store path
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_store_path">
         <code class="literal">
          keyring_hashicorp_store_path
         </code>
        </a>
       </td>
       <td>
        Yes
       </td>
      </tr>
      <tr>
       <th scope="row">
        Authorization Path
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_auth_path">
         <code class="literal">
          keyring_hashicorp_auth_path
         </code>
        </a>
       </td>
       <td>
        No
       </td>
      </tr>
      <tr>
       <th scope="row">
        CA certificate file path
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_ca_path">
         <code class="literal">
          keyring_hashicorp_ca_path
         </code>
        </a>
       </td>
       <td>
        No
       </td>
      </tr>
      <tr>
       <th scope="row">
        Cache control
       </th>
       <td>
        <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_caching">
         <code class="literal">
          keyring_hashicorp_caching
         </code>
        </a>
       </td>
       <td>
        No
       </td>
      </tr>
     </tbody>
    </table>
   </div>
   <p>
    To be usable during the server startup process,
    <code class="literal">
     keyring_hashicorp
    </code>
    must be loaded using the
    <a class="link" href="server-options.html#option_mysqld_early-plugin-load">
     <code class="option">
      --early-plugin-load
     </code>
    </a>
    option. As
          indicated by the preceding table, several plugin-related
          system variables are mandatory and must also be set. For
          example, use these lines in the server
    <code class="filename">
     my.cnf
    </code>
    file, adjusting the
    <code class="filename">
     .so
    </code>
    suffix and file locations for your
          platform as necessary:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa28913588"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">early-plugin-load</span><span class="token attr-value"><span class="token punctuation">=</span>keyring_hashicorp.so</span>
<span class="token constant">keyring_hashicorp_role_id</span><span class="token attr-value"><span class="token punctuation">=</span>'ee3b495c-d0c9-11e9-8881-8444c71c32aa'</span>
<span class="token constant">keyring_hashicorp_secret_id</span><span class="token attr-value"><span class="token punctuation">=</span>'0512af29-d0ca-11e9-95ee-0010e00dd718'</span>
<span class="token constant">keyring_hashicorp_store_path</span><span class="token attr-value"><span class="token punctuation">=</span>'/v1/kv/mysql'</span>
<span class="token constant">keyring_hashicorp_auth_path</span><span class="token attr-value"><span class="token punctuation">=</span>'/v1/auth/approle/login'</span></code></pre>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Per the
     <a class="ulink" href="https://www.vaultproject.io/api-docs" target="_blank">
      HashiCorp
            documentation
     </a>
     , all API routes are prefixed with a
            protocol version (which you can see in the preceding example
            as
     <code class="literal">
      /v1/
     </code>
     in the
     <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_store_path">
      <code class="literal">
       keyring_hashicorp_store_path
      </code>
     </a>
     and
     <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_auth_path">
      <code class="literal">
       keyring_hashicorp_auth_path
      </code>
     </a>
     values). If HashiCorp develops new protocol versions, it may
            be necessary to change
     <code class="literal">
      /v1/
     </code>
     to something
            else in your configuration.
    </p>
   </div>
   <p>
    MySQL Server authenticates against HashiCorp Vault using
          AppRole authentication. Successful authentication requires
          that two secrets be provided to Vault, a role ID and a secret
          ID, which are similar in concept to user name and password.
          The role ID and secret ID values to use are those obtained
          during the HashiCorp Vault setup procedure performed
          previously. To specify the two IDs, assign their respective
          values to the
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_role_id">
     <code class="literal">
      keyring_hashicorp_role_id
     </code>
    </a>
    and
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_secret_id">
     <code class="literal">
      keyring_hashicorp_secret_id
     </code>
    </a>
    system variables. The setup procedure also results in a store
          path of
    <code class="literal">
     /v1/kv/mysql
    </code>
    , which is the value to
          assign to
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_commit_store_path">
     <code class="literal">
      keyring_hashicorp_commit_store_path
     </code>
    </a>
    .
   </p>
   <p>
    At plugin initialization time,
    <code class="literal">
     keyring_hashicorp
    </code>
    attempts to connect to
          the HashiCorp Vault server using the configuration values. If
          the connection is successful, the plugin stores the values in
          corresponding system variables that have
    <code class="literal">
     _commit_
    </code>
    in their name. For example, upon
          successful connection, the plugin stores the values of
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_role_id">
     <code class="literal">
      keyring_hashicorp_role_id
     </code>
    </a>
    and
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_store_path">
     <code class="literal">
      keyring_hashicorp_store_path
     </code>
    </a>
    in
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_commit_role_id">
     <code class="literal">
      keyring_hashicorp_commit_role_id
     </code>
    </a>
    and
    <a class="link" href="keyring-system-variables.html#sysvar_keyring_hashicorp_commit_store_path">
     <code class="literal">
      keyring_hashicorp_commit_store_path
     </code>
    </a>
    .
   </p>
   <p>
    Reconfiguration at runtime can be performed with the
          assistance of the
    <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-hashicorp-update-config">
     <code class="literal">
      keyring_hashicorp_update_config()
     </code>
    </a>
    function:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Use
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
        </code>
       </a>
       statements to assign the desired new values to the
              configuration system variables shown in the preceding
              table. These assignments in themselves have no effect on
              ongoing plugin operation.
      </p>
     </li>
     <li class="listitem">
      <p>
       Invoke
       <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-hashicorp-update-config">
        <code class="literal">
         keyring_hashicorp_update_config()
        </code>
       </a>
       to cause the plugin to reconfigure and reconnect to the
              HashiCorp Vault server using the new variable values.
      </p>
     </li>
     <li class="listitem">
      <p>
       If the connection is successful, the plugin stores the
              updated configuration values in corresponding system
              variables that have
       <code class="literal">
        _commit_
       </code>
       in their
              name.
      </p>
     </li>
    </ol>
   </div>
   <p>
    For example, if you have reconfigured HashiCorp Vault to
          listen on port 8201 rather than the default 8200, reconfigure
    <code class="literal">
     keyring_hashicorp
    </code>
    like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa27489666"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> <span class="token keyword">GLOBAL</span> keyring_hashicorp_server_url <span class="token operator">=</span> <span class="token string">'https://127.0.0.1:8201'</span><span class="token punctuation">;</span>
<span class="token output">Query OK, 0 rows affected (0.00 sec)</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> keyring_hashicorp_update_config<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> keyring_hashicorp_update_config()    <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Configuration update was successful. <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">1 row in set (0.03 sec)</span></code></pre>
   </div>
   <p>
    If the plugin is not able to connect to HashiCorp Vault during
          initialization or reconfiguration and there was no existing
          connection, the
    <code class="literal">
     _commit_
    </code>
    system variables
          are set to
    <code class="literal">
     'Not committed'
    </code>
    for
          string-valued variables, and
    <code class="literal">
     OFF
    </code>
    for
          Boolean-valued variables. If the plugin is not able to connect
          but there was an existing connection, that connection remains
          active and the
    <code class="literal">
     _commit_
    </code>
    variables reflect
          the values used for it.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     If you do not set the mandatory system variables at server
            startup, or if some other plugin initialization error
            occurs, initialization fails. In this case, you can use the
            runtime reconfiguration procedure to initialize the plugin
            without restarting the server.
    </p>
   </div>
   <p>
    For additional information about the
    <code class="literal">
     keyring_hashicorp
    </code>
    plugin-specific system
          variables and function, see
    <a class="xref" href="keyring-system-variables.html" title="8.4.4.16 Keyring System Variables">
     Section 8.4.4.16, “Keyring System Variables”
    </a>
    , and
    <a class="xref" href="keyring-functions-plugin-specific.html" title="8.4.4.13 Plugin-Specific Keyring Key-Management Functions">
     Section 8.4.4.13, “Plugin-Specific Keyring Key-Management Functions”
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
