access_country_name | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will request a certificate without this attribute.

access_email_address | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will request a certificate without this attribute.

access_locality_name | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will request a certificate without this attribute.

access_organization | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will request a certificate without this attribute.

access_organizational_unit | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will request a certificate without this attribute.

access_sans_dns | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will automatically generate subject alternative names.

access_sans_ip | string

Comma-separated list of IP addresses to include as SANs for the access certificate. The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. These are in addition to IPs automatically detected by the charm.

access_state_or_province_name | string

The OpenBao charm will use this configuration option when requesting a certificate from a TLS provider using the tls-certificates-access charm relation interface. If not set, the OpenBao charm will request a certificate without this attribute.

acme_allow_any_name | boolean

Allow the ACME server of OpenBao to issue certificates for any domain name. The OpenBao charm will use this configuration option in the context of acting as an intermediate CA.

acme_allow_bare_domains | boolean

Default: True

Specifies if clients can request certificates matching the value of the actual domains themselves. For example, if allowed_domains contains example.com, setting this to true allows clients to actually request a certificate for example.com.

acme_allow_ip_sans | boolean

Allow the ACME server of OpenBao to issue certificates with IP Subject Alternative Names. The OpenBao charm will use this configuration option in the context of acting as an intermediate CA.

acme_allow_subdomains | boolean

Specifies if clients can request certificates with common names that are subdomains of the common name in the allowed_domains list. This includes wildcard subdomains. For example, an allowed_domains value of example.com with this option set to true will allow foo.example.com and fou.bar.example.com as well as *.example.com.

acme_allow_wildcard_certificates | boolean

Default: True

Specifies if clients can request certificates certificates with RFC 6125 wildcards in the CN field. When set to False, OpenBao will not issue wildcards, even if they would've been allowed by another option. OpenBao supports the following four wildcard types: - *.example.com: a single wildcard as the entire left-most label - foo*.example.com: a single suffixed wildcard in the left-most label - *foo.example.com: a single prefixed wildcard in the left-most label - f*o.example.com: a single interior wildcard in the left-most label

acme_allowed_domains | string

A comma-separated list of domain names for which the OpenBao charm can sign certificates. The OpenBao charm will use this configuration option in the context of acting as an intermediate CA. Certificate requests for clients using the ACME server of OpenBao will need to use a domain name from this list.

acme_ca_common_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. This option is required when using the tls-certificates-acme charm relation interface.

acme_ca_country_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

acme_ca_email_address | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

acme_ca_locality_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

acme_ca_organization | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

acme_ca_organizational_unit | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

acme_ca_sans_dns | string

Comma-separated list of DNS names for the CA certificate. The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will automatically generate subject alternative names.

acme_ca_state_or_province_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-acme charm relation interface. Requirers using the ACME server of OpenBao will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

acme_country | string

This value specifies the C (Country) value in the Subject field of the certificate issued by OpenBao ACME. If not set the issued certificate will not have a C value in the Subject field.

acme_locality | string

This value specifies the L (Locality) value in the Subject field of the certificate issued by OpenBao PKI. If not set the issued certificate will not have an L value in the Subject field.

acme_organization | string

This value specifies the O (Organization) value in the Subject field of the certificate issued by OpenBao ACME. If not set the issued certificate will not have an O value in the Subject field.

acme_organizational_unit | string

This value specifies the OU (Organizational Unit) value in the Subject field of the certificate issued by OpenBao ACME. If not set the issued certificate will not have an OU value in the Subject field.

acme_province | string

This value specifies the ST (State or Province) value in the Subject field of the certificate issued by OpenBao ACME. If not set the issued certificate will not have a ST value in the Subject field.

default_lease_ttl | string

Default: 168h

Specifies the default lease duration for OpenBao's tokens and secrets.

hsm-config-secret-id | string

Juju secret ID containing PKCS#11 HSM auto-unseal settings. Leave unset to keep Shamir seal. The secret must be granted to this application and should include: pin (required); slot and/or token-label; key-label and/or key-id. Optional lib is the PKCS#11 module filename (or relative path) inside the attached hsm-lib directory. Also attach the hsm-lib resource (a tarball of the module plus shared-library dependencies). Enabling PKCS#11 is one-way: after OpenBao is initialized with this seal, you cannot go back to Shamir by unsetting this option.

log_level | string

Default: info

The log verbosity level. Supported values (in order of descending detail) are trace, debug, info, warn, and error.

logrotate_frequency | string

Default: daily

How often to rotate syslog (daily, weekly, monthly)

max_lease_ttl | string

Default: 720h

Specifies the maximum possible lease duration for OpenBao's tokens and secrets.

pki_allow_any_name | boolean

Allow the OpenBao charm to sign certificates coming from the openbao-pki integration for any domain name. The OpenBao charm will use this configuration option in the context of acting as an intermediate CA.

pki_allow_bare_domains | boolean

Default: True

Specifies if clients can request certificates matching the exact value of the domains listed in pki_allowed_domains (or pki_ca_common_name if not set). For example, if pki_allowed_domains is example.com, this option allows issuing a certificate for example.com itself. When disabled, only subdomains (if pki_allow_subdomains is true) can be issued, not the base domain.

pki_allow_ip_sans | boolean

Allow the OpenBao charm to sign requests with IP Subject Alternative Names. The OpenBao charm will use this configuration option in the context of acting as an intermediate CA.

pki_allow_subdomains | boolean

Specifies if clients can request certificates with common names that are subdomains of the common name in the allowed_domains list. This includes wildcard subdomains. For example, an allowed_domains value of example.com with this option set to true will allow foo.example.com and fou.bar.example.com as well as *.example.com.

pki_allow_wildcard_certificates | boolean

Default: True

Specifies if clients can request certificates certificates with RFC 6125 wildcards in the CN field. When set to False, OpenBao will not issue wildcards, even if they would've been allowed by another option. OpenBao supports the following four wildcard types: - *.example.com: a single wildcard as the entire left-most label - foo*.example.com: a single suffixed wildcard in the left-most label - *foo.example.com: a single prefixed wildcard in the left-most label - f*o.example.com: a single interior wildcard in the left-most label

pki_allowed_domains | string

A comma-separated list of domain names for which the OpenBao charm can sign certificates. The OpenBao charm will use this configuration option in the context of acting as an intermediate CA. Certificate requests for charms integrating with OpenBao using the openbao-pki integration will need to use a domain name from this list.

pki_ca_common_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. This option is required when using the tls-certificates-pki charm relation interface.

pki_ca_country_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

pki_ca_email_address | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

pki_ca_locality_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

pki_ca_organization | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

pki_ca_organizational_unit | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

pki_ca_sans_dns | string

Comma-separated list of DNS names for the CA certificate. The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will automatically generate subject alternative names.

pki_ca_state_or_province_name | string

The OpenBao charm will use this configuration option when requesting a CA certificate from a TLS provider using the tls-certificates-pki charm relation interface. Charms integrating to OpenBao using the openbao-pki charm relation interface will receive signed certificates from that CA. If not set, the OpenBao charm will request a CA certificate without this attribute.

pki_country | string

This value specifies the C (Country) value in the Subject field of the certificate issued by OpenBao PKI. If not set the issued certificate will not have a C value in the Subject field.

pki_locality | string

This value specifies the L (Locality) value in the Subject field of the certificate issued by OpenBao PKI. If not set the issued certificate will not have an L value in the Subject field.

pki_organization | string

This value specifies the O (Organization) value in the Subject field of the certificate issued by OpenBao PKI. If not set the issued certificate will not have an O value in the Subject field.

pki_organizational_unit | string

This value specifies the OU (Organizational Unit) value in the Subject field of the certificate issued by OpenBao PKI. If not set the issued certificate will not have an OU value in the Subject field.

pki_province | string

This value specifies the ST (State or Province) value in the Subject field of the certificate issued by OpenBao PKI. If not set the issued certificate will not have a ST value in the Subject field.

pki_self_signed_ca_validity | int

Default: 87600

The validity period in hours for the self-signed CA certificate when using OpenBao's built-in PKI without an external CA relation (tls-certificates-pki). Default is 87600 hours (10 years). This option is only used when the tls-certificates-pki relation is not present and pki_ca_common_name is configured.

Channel	Revision	Published	Runs on
latest/edge	4	29 Sep 2026	Ubuntu 26.04 Ubuntu 24.04
latest/edge	3	29 Sep 2026	Ubuntu 26.04 Ubuntu 24.04