The MySQL Keyring So that you can enter the remaining commands, put the  vault server  command in the background or open another terminal before continuing. 4. Initialize the HashiCorp Vault server. Note The operations described in this step are required only when starting Vault the first time, to obtain the unseal key and root token. Subsequent Vault instance restarts require only unsealing using the unseal key. Issue the following commands (assuming Bourne shell syntax): export VAULT_SKIP_VERIFY=1 vault operator init -n 1 -t 1 The first command enables the  vault  command to temporarily ignore the fact that no company certificate has been added to the system trust store. It compensates for the fact that our self-signed CA is not added to that store. (For production use, such a certificate should be added.) The second command creates a single unseal key with a requirement for a single unseal key to be present for unsealing. (For production use, an instance would have multiple unseal keys with up to that many keys required to be entered to unseal it. The unseal keys should be delivered to key custodians within the company. Use of a single key might be considered a security issue because that permits the vault to be unsealed by a single key custodian.) Vault should reply with information about the unseal key and root token, plus some additional text (the actual unseal key and root token values differ from those shown here): ... Unseal Key 1: I2xwcFQc892O0Nt2pBiRNlnkHzTUrWS+JybL39BjcOE= Initial Root Token: s.vTvXeo3tPEYehfcd9WH7oUKz ... Store the unseal key and root token in a secure location. 5. Unseal the HashiCorp Vault server. Use this command to unseal the Vault server: When prompted to enter the unseal key, use the key obtained previously during Vault initialization. Vault should produce output indicating that setup is complete and the vault is unsealed. vault operator unseal 1423