Itential Platform can encounter difficulties when connecting to HashiCorp Vault servers that use HTTPS. In such cases, the following error message is often logged by Itential Platform:
UNABLE_TO_VERIFY_LEAF_SIGNATURE
This occurs when Itential Platform does not recognize or cannot access the SSL certificate chain used by the affected Vault servers.
To fix this issue, perform the following steps on all Platform servers in your environment.
Copy the contents of all SSL certificates used by Vault to the vault.cert file. For example, if your Vault server uses an end-user certificate, an intermediate certificate, and a root certificate, the resulting vault.cert file should look similar to the following:
Make sure the itential user has read-only access to the vault.cert file. No access should be granted to any groups or other users (numeric permission 400).
Determine the location of the Platform service file automation-platform.service by executing the systemctl status automation-platform command. In the following example, the service file is located at /usr/lib/systemd/system/automation-platform.service.
For more information about integrating HashiCorp Vault with Itential Platform, refer to the HashiCorp Vault Encryption section of the documentation.