Skip to main content
Welcome to this tutorial on the Vault Transit Secrets Engine. In this guide, you’ll learn how to enable and configure the Transit engine, manage encryption keys, and perform encrypt, decrypt, and rewrap operations.

​
Table of Contents

​
Overview

The Transit Secrets Engine provides cryptographic functions as a service. It allows you to offload encryption, decryption, key management, and more to Vault without storing raw data. Learn more in the official docs: Transit Secrets Engine.

​
Verify Enabled Secrets Engines

First, check which secrets engines are active on your Vault dev server:
Expected output in dev mode:
In Vault dev mode, the cubbyhole/, identity/, secret/ (KV v2), and sys/ engines are enabled by default.

​
Enable the Transit Engine

Enable the Transit engine at the default path transit/:
Verify it was added:
You can also add a description when enabling:

​
Create and Inspect an Encryption Key

Create a new key named training:
Then read its configuration:
Key configuration highlights:

​
Rotate an Encryption Key

Rotate training to generate a new version:
Verify the version bump:

​
Encrypt Data

  1. Base64-encode your plaintext:
  2. Encrypt the encoded string:
Sample response:
Store the ciphertext for later use.

​
Rewrap Data After Rotation

After rotating to version 3:
Rewrap the version 2 ciphertext to version 3:
Response:

​
Decrypt Ciphertexts

Decrypt version 2:
Decrypt version 3:
Both return the same Base64 plaintext.

​
Enforce Minimum Decryption Version

To block decryption of older ciphertext, set min_decryption_version=3:
Verify:
Attempting to decrypt version 2 now fails:
Any ciphertext with a version lower than the min_decryption_version will be rejected.
Decryption of version 3 still succeeds:

​
Conclusion

In this lesson, you have:
  • Enabled and configured the Transit Secrets Engine
  • Created, rotated, and inspected encryption keys
  • Encrypted, decrypted, and rewrapped data
  • Enforced minimum decryption version policies
For more information, visit the Vault Transit Secrets Engine documentation.

Watch Video

Practice Lab