Skip to content

Knowledge Base · Category 11

External credential stores

3 articles · 1 with tutorial video

By default, TLSPilot stores all credentials encrypted in the Windows Credential Manager of the management host. Instead, you can retrieve the secrets from an external credential store: CyberArk, Delinea, BeyondTrust Password Safe, HashiCorp Vault KV or Azure Key Vault (secrets). Which stores are available depends on your edition, see chapter Optional features. This is particularly useful if the external store rotates passwords, as TLSPilot then always uses the current password. The following example uses HashiCorp Vault KV. The settings of the other stores differ; the dialog shows the fields required for the selected store.

Articles in this category

  1. 11.1

    Connect an external credential store

    First, you connect TLSPilot to the external store in the settings.

    Tutorial 18
  2. 11.2

    Use a secret from the external store

    Once the store is connected, you can create credentials whose secret is retrieved from the store instead of being stored in TLSPilot.

  3. 11.3

    Use managed service accounts

    Instead of a user account with a password, you can use a group managed or delegated managed service account for Windows targets, which is the better choice in most cases.