Prepare the company and HashiCorp Vault server keys.准备公司和HashiCorp Vault服务器密钥。

Use the following commands to generate the key files:使用以下命令生成密钥文件：

openssl genrsa -aes256 -out company.key 4096
openssl genrsa -aes256 -out vault.key 2048

The commands produce files holding the company private key (company.key) and the Vault server private key (vault.key). The keys are randomly generated RSA keys of 4,096 and 2,048 bits, respectively.这些命令生成包含公司私钥（company.key）和Vault服务器私钥（vault.key）的文件。密钥分别是4096和2048位的随机生成的RSA密钥。

Each command prompts for a password. For testing purposes, the password is not required. To disable it, omit the -aes256 argument.每个命令都会提示输入密码。出于测试目的，不需要密码。要禁用它，请省略-aes256参数。

The key files hold sensitive information and should be stored in a secure location. The password (also sensitive) is required later, so write it down and store it in a secure location.密钥文件包含敏感信息，应存储在安全位置。稍后需要密码（也很敏感），所以把它写下来并存储在安全的位置。

(Optional) To check key file content and validity, use the following commands:（可选）要检查密钥文件内容和有效性，请使用以下命令：

openssl rsa -in company.key -check
openssl rsa -in vault.key -check

Create the company CA certificate.创建公司CA证书。

Use the following command to create a company CA certificate file named company.crt that is valid for 365 days (enter the command on a single line):使用以下命令创建一个名为company.crt的公司CA证书文件，有效期为365天（在单行中输入命令）：

openssl req -x509 -new -nodes -key company.key
  -sha256 -days 365 -out company.crt

If you used the -aes256 argument to perform key encryption during key generation, you are prompted for the company key password during CA certificate creation. 如果在密钥生成过程中使用-aes256参数执行密钥加密，则在CA证书创建过程中会提示您输入公司密钥密码。You are also prompted for information about the certificate holder (that is, you or your company), as shown here:系统还会提示您输入证书持有人（即您或您的公司）的信息，如下所示：

Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

Answer the prompts with appropriate values.用适当的值回答提示。

Create a certificate signing request.创建证书签名请求。

To create a HashiCorp Vault server certificate, a Certificate Signing Request (CSR) must be prepared for the newly created server key. 要创建HashiCorp Vault服务器证书，必须为新创建的服务器密钥准备证书签名请求（CSR）。Create a configuration file named request.conf containing the following lines. 创建一个名为request.conf的配置文件，其中包含以下行。If the HashiCorp Vault server does not run on the local host, substitute appropriate CN and IP values, and make any other changes required.如果HashiCorp Vault服务器未在本地主机上运行，请替换适当的CN和IP值，并进行所需的任何其他更改。

[req]
distinguished_name = vault
x509_entensions = v3_req
prompt = no

[vault]
C = US
ST = CA
L = RWC
O = Company
CN = 127.0.0.1

[v3_req]
subjectAltName = @alternatives
authorityKeyIdentifier = keyid,issuer
basicConstraints = CA:TRUE

[alternatives]
IP = 127.0.0.1

Use this command to create the signing request:使用此命令创建签名请求：

openssl req -new -key vault.key -config request.conf -out request.csr

The output file (request.csr) is an intermediate file that serves as input for creation of the server certificate.输出文件（request.csr）是一个中间文件，用作创建服务器证书的输入。

Create the HashiCorp Vault server certificate.创建HashiCorp Vault服务器证书。

Sign the combined information from the HashiCorp Vault server key (vault.key) and the CSR (request.csr) with the company certificate (company.crt) to create the HashiCorp Vault server certificate (vault.crt). 使用公司证书（company.crt）对HashiCorp Vault服务器密钥（vault.key）和CSR（request.csr）的组合信息进行签名，以创建HashiCorpVault服务器证书（vaultcrt）。Use the following command to do this (enter the command on a single line):使用以下命令执行此操作（在单行中输入命令）：

openssl x509 -req -in request.csr
  -CA company.crt -CAkey company.key -CAcreateserial
  -out vault.crt -days 365 -sha256

To make the vault.crt server certificate useful, append the contents of the company.crt company certificate to it. This is required so that the company certificate is delivered along with the server certificate in requests.要使vault.crt服务器证书有用，请将company.crt公司证书的内容附加到证书中。这是必需的，以便在请求中随服务器证书一起交付公司证书。

cat company.crt >> vault.crt

If you display the contents of the vault.crt file, it should look like this:如果显示vault.crt文件的内容，它应该看起来像这样：

-----BEGIN CERTIFICATE-----
... content of HashiCorp Vault server certificate ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... content of company certificate ...
-----END CERTIFICATE-----

Fetch the HashiCorp Vault binary.获取HashiCorp Vault二进制文件。

Download the HashiCorp Vault binary appropriate for your platform from https://www.vaultproject.io/downloads.html.从https://www.vaultproject.io/downloads.html下载适用于您平台的HashiCorp Vault二进制文件。

Extract the content of the archive to produce the executable vault command, which is used to perform HashiCorp Vault operations. If necessary, add the directory where you install the command to the system path.提取存档的内容以生成可执行的vault命令，该命令用于执行HashiCorp vault操作。如有必要，将安装命令的目录添加到系统路径中。

(Optional) HashiCorp Vault supports autocomplete options that make it easier to use. For more information, see https://learn.hashicorp.com/vault/getting-started/install#command-completion.（可选）HashiCorp Vault支持自动补全选项，使其更易于使用。有关更多信息，请参阅https://learn.hashicorp.com/vault/getting-started/install#command-completion。

Create the HashiCorp Vault server configuration file.创建HashiCorp Vault服务器配置文件。

Prepare a configuration file named config.hcl with the following content. 准备一个名为config.hcl的配置文件，其中包含以下内容。For the tls_cert_file, tls_key_file, and path values, substitute path names appropriate for your system.对于tls_cert_file、tls_key_file和path值，请替换适合您系统的路径名。

listener "tcp" {
  address="127.0.0.1:8200"
  tls_cert_file="/home/username/certificates/vault.crt"
  tls_key_file="/home/username/certificates/vault.key"
}

storage "file" {
  path = "/home/username/vaultstorage/storage"
}

ui = true

Start the HashiCorp Vault server.启动HashiCorp Vault服务器。

To start the Vault server, use the following command, where the -config option specifies the path to the configuration file just created:要启动Vault服务器，请使用以下命令，其中-config选项指定刚刚创建的配置文件的路径：

vault server -config=config.hcl

During this step, you may be prompted for a password for the Vault server private key stored in the vault.key file.在此步骤中，系统可能会提示您输入存储在vault.key文件中的Vault服务器私钥的密码。

The server should start, displaying some information on the console (IP, port, and so forth).服务器应该启动，在控制台上显示一些信息（IP、端口等）。

So that you can enter the remaining commands, put the vault server command in the background or open another terminal before continuing.为了输入其余命令，请在继续之前将vault server命令置于后台或打开另一个终端。

Initialize the HashiCorp Vault server.初始化HashiCorp Vault服务器。

Issue the following commands (assuming Bourne shell syntax):发出以下命令（假设Bourne shell语法）：

export VAULT_SKIP_VERIFY=1
vault operator init -n 1 -t 1

The first command enables the vault command to temporarily ignore the fact that no company certificate has been added to the system trust store. 第一个命令使vault命令能够暂时忽略没有公司证书添加到系统信任存储中的事实。It compensates for the fact that our self-signed CA is not added to that store. (For production use, such a certificate should be added.)它弥补了自签名CA没有添加到该商店的事实。（对于生产使用，应添加此类证书。）

The second command creates a single unseal key with a requirement for a single unseal key to be present for unsealing. (For production use, an instance would have multiple unseal keys with up to that many keys required to be entered to unseal it. 第二个命令创建一个单独的解封密钥，并要求在解封时存在一个解封密钥。（对于生产使用，一个实例将有多个解封密钥，需要输入多达该数量的密钥才能解封它。The unseal keys should be delivered to key custodians within the company. Use of a single key might be considered a security issue because that permits the vault to be unsealed by a single key custodian.)未密封的钥匙应交给公司内的钥匙保管人。使用单个密钥可能被认为是一个安全问题，因为这允许单个密钥保管人打开保险库。）

Vault should reply with information about the unseal key and root token, plus some additional text (the actual unseal key and root token values differ from those shown here):Vault应回复有关解封密钥和根令牌的信息，以及一些额外的文本（实际的解封密钥值和根令牌值与此处显示的值不同）：

...
Unseal Key 1: I2xwcFQc892O0Nt2pBiRNlnkHzTUrWS+JybL39BjcOE=
Initial Root Token: s.vTvXeo3tPEYehfcd9WH7oUKz
...

Store the unseal key and root token in a secure location.将解封密钥和根令牌存储在安全位置。

Unseal the HashiCorp Vault server.解除HashiCorp Vault服务器的密封。

Use this command to unseal the Vault server:使用此命令打开Vault服务器的密封：

vault operator unseal

When prompted to enter the unseal key, use the key obtained previously during Vault initialization.当系统提示输入解封密钥时，请使用之前在Vault初始化期间获得的密钥。

Vault should produce output indicating that setup is complete and the vault is unsealed.Vault应生成输出，指示设置已完成且Vault已解封。

Log in to the HashiCorp Vault server and verify its status.登录HashiCorp Vault服务器并验证其状态。

Prepare the environment variables required for logging in as root:准备以root身份登录所需的环境变量：

vault login s.vTvXeo3tPEYehfcd9WH7oUKz

For the token value in that command, substitute the content of the root token obtained previously during Vault initialization.对于该命令中的令牌值，替换之前在Vault初始化期间获得的根令牌的内容。

Verify the Vault server status:验证Vault服务器状态：

vault status

The output should contain these lines (among others):输出应包含以下行（以及其他行）：

...
Initialized     true
Sealed          false
...

Set up HashiCorp Vault authentication and storage.设置HashiCorp Vault身份验证和存储。

Enable the AppRole authentication method and verify that it is in the authentication method list:启用AppRole身份验证方法，并验证它是否在身份验证方法列表中：

vault auth enable approle
vault auth list

Enable the Vault KeyValue storage engine:启用Vault KeyValue存储引擎：

vault secrets enable -version=1 kv

Create and set up a role for use with the keyring_hashicorp plugin (enter the command on a single line):创建并设置一个与keyring_hashicorp插件一起使用的角色（在一行中输入命令）：

vault write auth/approle/role/mysql token_num_uses=0
  token_ttl=20m token_max_ttl=30m secret_id_num_uses=0

Add an AppRole security policy.添加AppRole安全策略。

Prepare a policy that to permit the previously created role to access appropriate secrets. 制定一项策略，允许之前创建的角色访问适当的机密。Create a new file named mysql.hcl with the following content:创建一个名为mysql.hcl的新文件，内容如下：

path "kv/mysql/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

Import the policy file to the Vault server to create a policy named mysql-policy, then assign the policy to the new role:将策略文件导入Vault服务器以创建名为mysql-policy的策略，然后将该策略分配给新角色：

vault policy write mysql-policy mysql.hcl
vault write auth/approle/role/mysql policies=mysql-policy

Obtain the ID of the newly created role and store it in a secure location:获取新创建角色的ID并将其存储在安全位置：

vault read auth/approle/role/mysql/role-id

Generate a secret ID for the role and store it in a secure location:为角色生成一个秘密ID并将其存储在安全位置：

vault write -f auth/approle/role/mysql/secret-id

After these AppRole role ID and secret ID credentials are generated, they are expected to remain valid indefinitely. 生成这些AppRole角色ID和秘密ID凭据后，它们将无限期保持有效。They need not be generated again and the keyring_hashicorp plugin can be configured with them for use on an ongoing basis. 它们不需要再次生成，keyring_hashicorp插件可以配置它们以供持续使用。For more information about AuthRole authentication, visit https://www.vaultproject.io/docs/auth/approle.html.有关AuthRole身份验证的更多信息，请访问https://www.vaultproject.io/docs/auth/approle.html。

Use SET statements to assign the desired new values to the configuration system variables shown in the preceding table. These assignments in themselves have no effect on ongoing plugin operation.使用SET语句将所需的新值分配给上表所示的配置系统变量。这些任务本身对正在进行的插件操作没有影响。

Invoke keyring_hashicorp_update_config() to cause the plugin to reconfigure and reconnect to the HashiCorp Vault server using the new variable values.调用keyring_hashicorp_update_config()，使插件使用新的变量值重新配置并重新连接到hashicorp Vault服务器。

If the connection is successful, the plugin stores the updated configuration values in corresponding system variables that have _commit_ in their name.如果连接成功，插件会将更新的配置值存储在相应的系统变量中，这些变量的名称中有_commit_。