Skip to main content
In this hands-on lab, you’ll learn how to enable and configure the Vault Transit Secrets Engine. You’ll work through:
  • Enabling Transit at its mount point
  • Creating, rotating, and inspecting keys
  • Encrypting and decrypting data
  • Rewrapping ciphertext after key rotation
  • Enforcing a minimum decryption version
This demo uses a Vault development server for simplicity. Do not use a dev server in production workloads.

​
Prerequisites

  • A running Vault development server (default mounts).
  • The vault CLI installed and authenticated (VAULT_ADDR, VAULT_TOKEN).

​
1. Verify Installed Secret Engines

Ensure Transit is not yet enabled:

​
2. Enable the Transit Secrets Engine

Enable at the default mount (transit/):
Confirm it’s listed:
Optionally add a description when enabling:

​
3. Create an Encryption Key

Create a new key named training (default: AES-256-GCM96):
Inspect its metadata:
Key metadata fields include latest_version, min_decryption_version, and supported operations.

​
4. Rotate the Key

Generate a new version for the training key:
You should see latest_version incremented.

​
5. Encrypt Data

First, Base64-encode your plaintext:
Encrypt with the training key:
Response fields:

​
6. Rotate Again & Rewrap Ciphertext

Rotate to version 3:
Rewrap an existing ciphertext (v2 → v3):
Response includes new ciphertext and key_version=3.

​
7. Decrypt Ciphertext

​
7.1 Decrypt Version 2

Decode the Base64 plaintext:

​
7.2 Decrypt Version 3

​
8. Enforce a Minimum Decryption Version

Disallow decryption of data encrypted with older key versions:
After setting min_decryption_version=3, any attempt to decrypt version 2 will fail with:

​
References

Watch Video

Practice Lab