feat: add support for PKI module to generate certificates

CHANGELOG.md

@@ -13,6 +13,7 @@
 
 ### Features
 * Allow parsing JSON from full dataset in `SecretResponse` (#130)
+* Introduce `pki()` client to issue certificates via Vault PKI engine (#131)
 
 ### Removal
 * Remove deprecated `read...Credentials()` methods (#112)

README.md

@@ -31,6 +31,7 @@ Java Vault Connector is a connector library for [Vault](https://www.vaultproject
     * KV v1 and v2 support
     * Database secret handling
 * Transit API support
+* PKI certificate support
 * Connector Factory with builder pattern
 * Tested against Vault 1.3 to 2.0
 

src/main/java/de/stklcode/jvault/connector/HTTPVaultConnector.java

@@ -252,6 +252,11 @@ public SysClientImpl sys() {
         return new SysClientImpl();
     }
 
+    @Override
+    public PkiClientImpl pki() {
+        return new PkiClientImpl();
+    }
+
     @Override
     public final void close() {
         authorized = false;
@@ -764,4 +769,40 @@ public final List<AuthBackend> getAuthBackends() throws VaultConnectorException
             return amr.supportedMethods().values().stream().map(AuthMethod::type).toList();
         }
     }
+
+    /**
+     * Sub-client for PKI methods.
+     */
+    public class PkiClientImpl implements PkiClient {
+
+        @Override
+        public PkiResponse generateCertificateAndKey(final String name, final PkiRequest pkiRequest) throws VaultConnectorException {
+            return request.post(PKI_ISSUE + encode(name), pkiRequest, token, PkiResponse.class);
+        }
+
+        @Override
+        public PkiResponse generateCertificateAndKey(final String issuer, final String name, final PkiRequest pkiRequest) throws VaultConnectorException {
+            return request.post(PKI_ISSUER_ISSUE.formatted(encode(issuer), encode(name)), pkiRequest, token, PkiResponse.class);
+        }
+
+        @Override
+        public PkiRevocationResponse revokeBySerial(String serial) throws VaultConnectorException {
+            return request.post(PKI_REVOKE, Map.of("serial_number", serial), token, PkiRevocationResponse.class);
+        }
+
+        @Override
+        public PkiRevocationResponse revokeCertificate(String certificate) throws VaultConnectorException {
+            return request.post(PKI_REVOKE, Map.of("certificate", certificate), token, PkiRevocationResponse.class);
+        }
+
+        @Override
+        public PkiCaResponse readCaCert() throws VaultConnectorException {
+            return request.get(PKI_CA_CERT, emptyMap(), token, PkiCaResponse.class);
+        }
+
+        @Override
+        public PkiCaResponse readIssuerCert(String issuer) throws VaultConnectorException {
+            return request.get(PKI_ISSUER_CERT.formatted(encode(issuer)), emptyMap(), token, PkiCaResponse.class);
+        }
+    }
 }

src/main/java/de/stklcode/jvault/connector/PkiClient.java

@@ -0,0 +1,90 @@
+/*
+ * Copyright 2016-2026 Stefan Kalscheuer
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package de.stklcode.jvault.connector;
+
+import de.stklcode.jvault.connector.exception.VaultConnectorException;
+import de.stklcode.jvault.connector.model.PkiRequest;
+import de.stklcode.jvault.connector.model.response.PkiCaResponse;
+import de.stklcode.jvault.connector.model.response.PkiResponse;
+import de.stklcode.jvault.connector.model.response.PkiRevocationResponse;
+
+/**
+ * PKI client interface.
+ * Provides methods to interact with Vault's PKI API.
+ *
+ * @since 2.0.0
+ */
+public interface PkiClient {
+
+    /**
+     * Generate a new set of credentials (certificate and private key) based on the given role name using.
+     * The issuer is determined by role.
+     *
+     * @param role    The role name
+     * @param request The request
+     * @return PKI response
+     * @throws VaultConnectorException on error
+     */
+    PkiResponse generateCertificateAndKey(String role, PkiRequest request) throws VaultConnectorException;
+
+    /**
+     * Generate a new set of credentials (certificate and private key) based on the given role and issuer.
+     *
+     * @param issuer  The issuer reference
+     * @param role    The role name
+     * @param request The request
+     * @return PKI response
+     * @throws VaultConnectorException on error
+     */
+    PkiResponse generateCertificateAndKey(String role, String issuer, PkiRequest request) throws VaultConnectorException;
+
+    /**
+     * Request revocation of a certificate by serial number.
+     *
+     * @param serial Serial number of the certificate to revoke, in hyphen-separated or colon-separated hexadecimal
+     * @return Revocation response
+     * @throws VaultConnectorException on error
+     */
+    PkiRevocationResponse revokeBySerial(String serial) throws VaultConnectorException;
+
+    /**
+     * Request revocation of a certificate by serial number.
+     *
+     * @param certificate Certificate to revoke, in PEM format
+     * @return Revocation response
+     * @throws VaultConnectorException on error
+     */
+    PkiRevocationResponse revokeCertificate(String certificate) throws VaultConnectorException;
+
+    /**
+     * Read the default issuer's CA certificate.
+     *
+     * @return CA/issuer response
+     * @throws VaultConnectorException on error
+     */
+    PkiCaResponse readCaCert() throws VaultConnectorException;
+
+    /**
+     * Read the certificate of a specific issuer.
+     *
+     * @param issuer The issuer reference (may be "default")
+     * @return CA/issuer response
+     * @throws VaultConnectorException on error
+     */
+    PkiCaResponse readIssuerCert(String issuer) throws VaultConnectorException;
+
+}

src/main/java/de/stklcode/jvault/connector/VaultConnector.java

@@ -219,6 +219,14 @@ default SecretResponse renew(final String leaseID) throws VaultConnectorExceptio
      */
     SysClient sys();
 
+    /**
+     * Get client for PKI API.
+     *
+     * @return PKI client
+     * @since 2.0.0
+     */
+    PkiClient pki();
+
     /**
      * Read credentials for database backends.
      *

src/main/java/de/stklcode/jvault/connector/internal/VaultApiPath.java

@@ -27,6 +27,7 @@ public final class VaultApiPath {
     private static final String SYS = "sys";
     private static final String AUTH = "auth";
     private static final String TRANSIT = "transit";
+    private static final String PKI = "pki";
 
     // System paths
     public static final String SYS_AUTH = SYS + "/auth";
@@ -62,6 +63,13 @@ public final class VaultApiPath {
     public static final String TRANSIT_DECRYPT = TRANSIT + "/decrypt/";
     public static final String TRANSIT_HASH = TRANSIT + "/hash/";
 
+    // PKI engine paths
+    public static final String PKI_ISSUE = PKI + "/issue/";
+    public static final String PKI_ISSUER_ISSUE = PKI + "/%s/issue/%s";
+    public static final String PKI_REVOKE = PKI + "/revoke";
+    public static final String PKI_CA_CERT = PKI + "/cert/ca";
+    public static final String PKI_ISSUER_CERT = PKI + "/issuer/%s/json";
+
     /**
      * Private constructor to prevent instantiation.
      */