---
title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection
description: Deploy the latest version of Vault as a Kubernetes Operator on any cloud.
url: https://charmhub.io/vault-k8s/docs/h-use-vault-as-an-acme-server
---

# Vault

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

2.0/stable 590

```
juju deploy vault-k8s --channel 2.0/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://canonical-vault-charms.readthedocs-hosted.com/)

---

#### Contacts

##### Maintainers

+ [Matrix Channel](https://matrix.to/#/!yAkGlrYcBFYzYRvOlQ:ubuntu.com?via=ubuntu.com&via=matrix.org&via=mozilla.org)

* [Submit a bug](https://github.com/canonical/vault-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Use Vault as an ACME Server to obtain TLS certificates

In this how-to guide, we will configure Vault to act as an ACME server using [Vault’s PKI secrets engine](https://developer.hashicorp.com/vault/docs/secrets/pki). Here [self-signed-certificates](https://charmhub.io/self-signed-certificates) will be the parent CA.

The certificates issued by Vault will have a validity period that is half of its intermediate CA’s, which is determined by the root provider’s configuration, in this case, the self-signed certificates.

1. Configure Vault’s common name

```
juju config vault common_name=mydomain.com
```

1. Deploy the parent CA

```
juju deploy self-signed-certificates --channel 1/stable
```

1. Integrate Vault with its parent CA

```
juju integrate vault:tls-certificates-acme self-signed-certificates
```

Now the ACME server is accessible on `https://<Vault Address>:8200/v1/charm-acme/acme/directory`

Now you should be able to obtain a certificate from Vault using an ACME client, for example [Lego](https://go-acme.github.io/lego/).

---