Skip to main content
This guide demonstrates how to initialize HashiCorp Vault with encrypted recovery keys and a root token using public OpenPGP keys. In this example, we’ll use three public keys—btk.pub, frank.pub, and susan.pub—located in your current directory.

​
Prerequisites

  • Vault server (v1.10.0+ent) installed and running
  • Three PGP public keys: btk.pub, frank.pub, susan.pub
  • GPG (GnuPG) installed for decryption

​
1. Verify Your PGP Keys

List the .pub files to ensure your public keys are accessible:
Make sure these files are the intended public keys. Do not expose your private keys.

​
2. Confirm Vault Is Uninitialized

Check Vault’s status before initialization:
Vault should be initialized: false and sealed: true.

​
3. Initialize Vault with Encrypted Shares

Run the vault operator init command to:
  • Create 3 recovery shares
  • Require 2 shares to meet the threshold
  • Encrypt each share with our PGP keys
The file vaultinit.txt contains sensitive data. Store it in a secure location—never commit it to version control.

​
Initialization Parameters

​
4. Review the Initialization Output

Since the command redirected output to vaultinit.txt, your console is blank. Display the file to see each encrypted share and the root token:
Each recovery key is a Base64-encoded string—encrypted with the matching PGP public key. The root token remains in plaintext by default.

​
5. Decrypt a Recovery Share

To decrypt the share encrypted for Susan:
Ensure you have Susan’s private key and know the GPG passphrase to unlock it.
GPG will prompt for the passphrase:
The image shows a dialog box prompting the user to enter a passphrase to unlock an OpenPGP secret key. It includes details about the key, such as the key ID and creation date.
Once unlocked, you’ll see the plaintext recovery key:

​
6. Next Steps

With at least two decrypted shares (meeting the threshold), you can:
  • Unseal Vault or a DR cluster
  • Generate a new root token
  • Perform emergency recovery
By encrypting each recovery share with a different PGP key, you ensure that only authorized users can decrypt their respective shares, strengthening Vault’s security model.

​
References

Watch Video

Practice Lab