{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/1856","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/1856/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/1856/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/1856/events","html_url":"https://github.com/hashicorp/vault/issues/1856","id":175175056,"number":1856,"title":"Vault configuration reload (add/remove listeners)","user":{"login":"ljagiello-fleetsmithsupport","id":20980797,"avatar_url":"https://avatars.githubusercontent.com/u/20980797?v=3","gravatar_id":"","url":"https://api.github.com/users/ljagiello-fleetsmithsupport","html_url":"https://github.com/ljagiello-fleetsmithsupport","followers_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/followers","following_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/following{/other_user}","gists_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/gists{/gist_id}","starred_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/subscriptions","organizations_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/orgs","repos_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/repos","events_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/events{/privacy}","received_events_url":"https://api.github.com/users/ljagiello-fleetsmithsupport/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-06T07:07:38Z","updated_at":"2016-09-06T07:07:38Z","closed_at":null,"body":"Hi,\r\n\r\nI believe it's a next part of (https://github.com/hashicorp/vault/issues/415). Reload TLS certs is great but you need at least one TLS cert for start. What I would like to do is bootstrap vault just with a limited for localhost `tls_disabled` listener. Issue new cert, replace unsecure listener with a new one where TLS cert was issued from Vault and reload vault.\r\n\r\nIt's possible right now to unseal vault, get cert, restart vault and unseal again or bootstrap with some fake cert and replace them but it sounds like a hack. From security perspective I think if you can right now replace cert and reload vault it's not more danger compare to add/remove listener. In theory you could add unsecure listener so maybe it could be limited only for TLS listeners."}}
{"actor":{"display_login":"ljagiello-fleetsmithsupport"}}