vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> View details.
* If the validation doesn't complete successfully, the status of your certificate changes to Deactivated. From your Secrets table, you can check the issuance details of your certificate by clicking the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> View details.
* If the validation doesn't complete successfully, the status of your certificate changes to Deactivated. You can use the [Get secret metadata](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-secret-metadata) API to check the resources.issuance_info field for issuance details on your certificate.
* After the certificate is issued, you can deploy it to your integrated apps, download it, or modify its rotation options.





 Ordering public certificates with integrated DNS providers in the UI 

You can order a certificate by using the Secrets Manager UI.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, click Add.
4. Click the Order public certificate tile.
5. Add a name and description to easily identify your certificate.
6. Select the

secret groupthat you want to assign to the secret.

Don't have a secret group?
Allowable values are: sign_intermediate, sign_csr, set_signed, revoke, rotate_crl.

--config ([ConfigAction](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-config-action-example-schema-v1))
: Properties that describe an action on a configuration element.





 Examples 

ibmcloud secrets-manager config-element-action --secret-type=private_cert --config-element=root_certificate_authorities --config-name=exampleString --action=sign_intermediate --config='{"common_name": "example.com", "alt_names": "exampleString", "ip_sans": "exampleString", "uri_sans": "exampleString", "other_sans": ["exampleString"], "ttl": "12h", "format": "pem", "max_path_length": 38, "exclude_cn_from_sans": false, "permitted_dns_domains": ["exampleString"], "use_csr_values": false, "ou": ["exampleString"], "organization": ["exampleString"], "country": ["exampleString"], "locality": ["exampleString"], "province": ["exampleString"], "street_address": ["exampleString"], "postal_code": ["exampleString"], "serial_number": "d9:be:fe:35:ba:09:42:b5", "csr": "exampleString"}'







 ibmcloud secrets-manager config-element-delete 

Delete a configuration element from the specified secret type.

ibmcloud secrets-manager config-element-delete --secret-type SECRET-TYPE --config-element CONFIG-ELEMENT --config-name CONFIG-NAME



 Command options
"secret_type": "private_cert",
"serial_number": "03:e2:c6:e4:0b:7d:30:e2:e2:78:1b:b9:13:fd:f0:fc:89:dd",
"signing_algorithm": "SHA256-RSA",
"state": 1,
"state_description": "active",
"updated_at": "2022-03-02T14:08:37Z",
"validity": {
"not_before": "2022-03-02T15:08:37Z",
"not_after": "2023-03-01T00:00:00Z"
},
"versions_total": 1
}





 Creating private certificates with Terraform 

The following example shows a configuration that you can use to create a private certificate.

resource "ibm_sm_private_certificate" "test_private_certificate" {
instance_id = local.instance_id
region = local.region
name = "test-private-certificate"
common_name = "my.example.com"
certificate_template = ibm_sm_private_certificate_configuration_template.test_ca_template.name
ttl = "90d"
}

After a certificate is issued, you can deploy it to your integrated apps, download it, or rotate it manually. For more information about the required and optional request parameters, see the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret).
: The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.





 Example 

ibmcloud secrets-manager configuration-action-create --name=configuration-name --config-action-prototype='{"action_type": "private_cert_configuration_action_rotate_crl"}' --x-sm-accept-configuration-type=private_cert_configuration_root_ca









 Notifications 

Enable lifecycle notifications for your instance by connecting to Event Notifications.



 ibmcloud secrets-manager notifications-registration-create 

Create a registration between a Secrets Manager instance and [Event Notifications](https://cloud.ibm.com/apidocs/event-notifications).

A successful request adds Secrets Manager as a source that you can reference from your Event Notifications instance. For more information about enabling notifications for Secrets Manager, check out the [docs](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications).

ibmcloud secrets-manager notifications-registration-create --event-notifications-instance-crn EVENT-NOTIFICATIONS-INSTANCE-CRN --event-notifications-source-name EVENT-NOTIFICATIONS-SOURCE-NAME [--event-notifications-source-description EVENT-NOTIFICATIONS-SOURCE-DESCRIPTION]



 Command options 

--event-notifications-instance-crn (string)
: A CRN that uniquely identifies an IBM Cloud resource. Required.

The maximum length is 512 characters. The minimum length is 9 characters.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 Secret rotation failed com.ibm.cloud.secrets-manager.secret_rotation_failed One time ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 Secret about to expire com.ibm.cloud.secrets-manager.secret_about_to_expire 90, 60, 30, 10, 1, 0 days before the secret expires ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) Not applicable<br><br>[1] ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) !
Command options 

--name (string)
: The name of the configuration. Required.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9](?:_-\.[A-Za-z0-9]+)$/.

--x-sm-accept-configuration-type (string)
: The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.





 Example 

ibmcloud secrets-manager configuration-delete --name=configuration-name --x-sm-accept-configuration-type=private_cert_configuration_root_ca







 ibmcloud secrets-manager configuration-action-create 

Create a configuration action. This operation supports the following actions:



* private_cert_configuration_action_sign_intermediate: Sign an intermediate certificate authority.
* private_cert_configuration_action_sign_csr: Sign a certificate signing request.
* private_cert_configuration_action_set_signed: Set a signed intermediate certificate authority.
* private_cert_configuration_action_revoke_ca_certificate: Revoke an internally signed intermediate certificate authority certificate.
* private_cert_configuration_action_rotate_crl: Rotate the certificate revocation list (CRL) of an intermediate certificate authority.



ibmcloud secrets-manager configuration-action-create --name NAME --config-action-prototype CONFIG-ACTION-PROTOTYPE [--x-sm-accept-configuration-type X-SM-ACCEPT-CONFIGURATION-TYPE]



 Command options 

--name (string)
: The name of the configuration. Required.

The maximum length is 128 characters.
When you order a certificate, domain validation takes place to verify the ownership of your selected domains. This process can take a few minutes to complete. After you submit your certificate details, Secrets Manager sends your request to the selected certificate authority. After a certificate is issued, you can deploy it to your integrated apps, download it, or rotate it manually. Your private key for SSL/TLS is generated directly in Secrets Manager and stored securely.

Need to check your order status? From your Secrets table, you can check the issuance details of your certificate by clicking the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> View details.







 Ordering public certificates with integrated DNS providers from the CLI 

To order a public certificate with an integrated DNS provider by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command) command.For example, the following command requests a public certificate secret from the certificate authority that you specify.

When you order a certificate, domain validation takes place to verify the ownership of your selected domains. This process can take a few minutes to complete.

ibmcloud secrets-manager secret-create --secret-prototype=
'[{
"name": "example-public-certificate",
"description": "Extended description for this secret.",
"secret_group_id": "bc656587-8fda-4d05-9ad8-b1de1ec7e712",
"labels":
"dev","us-south"
],
"dns": "dns_provider",
"common_name": "cert_common_name"
"alt_names":
Labels 2 - 30 characters<br><br>30 labels per secret 
 Versions For auditing purposes, the service retains the metadata of up to 50 versions for each secret, which you can review as part of a secret's [version history](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-version-history). 
 Locks 1000 
 Custom metadata 10 KB 
 Version custom metadata 10 KB 







 Limits for IAM credentials 

The following limits apply to IAM credentials.



Table 6. IAM credential limits

 Attribute Limit 

 Name 2 - 256 characters<br><br>The name of the secret can contain only alphanumeric characters, dashes, and dots. It must start and end with an alphanumeric character. 
 Description 2 - 1024 characters 
 Access groups 1 - 10 groups 
 Labels 2 - 30 characters<br><br>30 labels per secret 
 Time-to-live (TTL) / lease duration Minimum duration is 1 minute. Maximum is 90 days. 
 Versions 2 versions per secret (current and previous)<br><br>A secret version can be retrieved, rotated, or restored only if the defined time-to-live (TTL) or lease duration wasn't reached. For auditing purposes, the service retains the metadata of up to 50 versions for each secret, which you can review as part of a secret's [version history](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-version-history). 
 Locks 1000 
 Custom metadata 10 KB 
 Version custom metadata 10 KB 







 Limits for key-value secrets 

The following limits apply to key-value secrets.



Table 7. Key-value limits

 Attribute Limit 

 Name 2 - 256 characters<br><br>The name of the secret can contain only alphanumeric characters, dashes, and dots. It must start and end with an alphanumeric character. 
 Description 2 - 1024 characters 
 Secret value / payload 512 KB 
 Labels 2 - 30 characters<br><br>30 labels per secret 
 Locks 1000 
 Custom metadata 10 KB 
 Version custom metadata 10 KB
The KMS provider's private cloud service endpoint is used by default to download the encryption keys. To use the public cloud service endpoint instead, include the --public-endpoint option. The enablement process can take some time to complete.

ibmcloud oc kms enable -c <cluster_name_or_ID> --instance-id <kms_instance_ID> --crk <root_key_ID> [--public-endpoint]

During the enablement, you might not be able to access the Kubernetes master such as to update YAML configurations for deployments.
5. Verify that the KMS enablement process is finished. The process is finished when that the Master Status is Ready and Key management service is enabled.

ibmcloud oc cluster get -c <cluster_name_or_ID>

Example output when the enablement is in progress

NAME: <cluster_name>
ID: <cluster_ID>
...
Master Status: Key management service feature enablement in progress.

Example output when the master is ready

NAME: <cluster_name>
ID: <cluster_ID>
...
Master Status: Ready (1 min ago)
...
Key Management Service: enabled

After the KMS provider is enabled in the cluster, all cluster secrets are automatically encrypted.
6. Optional: [Verify that your secrets are encrypted](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionverify_kms).



Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.
View the details of a role that is assigned to a secret group.

vault read -format=json ibmcloud/iam_credentials/roles/groups/9ab2250f-a369-4e07-ade7-d417d63ad587/091ca93f-5c99-4078-9d7e-4801143030fd/metadata





 Output 

The command returns the following output:

{
"request_id": "cb4672e2-51d9-3a83-f8a2-717afe16e24a",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"access_groups": [
"AccessGroupId-985dc0a3-857b-48bd-b6d6-33819da7ba42"
],
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2020-10-09T17:13:47Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/791f5fb10986423e97aa8512f18b7e65:e415e570-f073-423a-abdc-55de9b58f54e::",
"description": "My test IAM credential that is assigned to a secret group.",
"id": "091ca93f-5c99-4078-9d7e-4801143030fd",
"labels": [
"test",
"us-south"
],
"last_update_date": "2020-10-09T17:13:47Z",
"creation_date": "2020-10-09T17:13:47Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/791f5fb10986423e97aa8512f18b7e65:e415e570-f073-423a-abdc-55de9b58f54e::",
"description": "My test IAM credential that is assigned to a secret group.",
"id": "091ca93f-5c99-4078-9d7e-4801143030fd",
"labels": [
"test",
"us-south"
],
"last_update_date": "2020-10-09T17:53:23Z",
"name": "test-iam-credential-in-group",
"secret_group_id": "9ab2250f-a369-4e07-ade7-d417d63ad587",
"secret_type": "IAM_CREDENTIALS",
"service_id": "ServiceId-ae06783c-0ab4-4b02-a78a-8dff7d0634c6",
"state": 1,
"state_description": "Active",
"ttl": 3600
},
"warnings": null
}

If the role belongs to a secret group, the data.secret_group_id value is included in the response to identify the secret group assignment.







 List roles 

Use the following commands to list the roles or secrets in your Secrets Manager instance.

List roles by type.

vault read [-format=FORMAT] ibmcloud/SECRET_TYPE/roles

List roles by secret group ID.

vault read [-format=FORMAT] ibmcloud/SECRET_TYPE/roles/groups/SECRET_GROUP_ID



 Prerequisites
private static String COS_AUTH_ENDPOINT = "https://iam.cloud.ibm.com/identity/token";
private static String COS_SERVICE_CRN = "<resource-instance-id>"; // "crn:v1:bluemix:public:cloud-object-storage:global:a/<CREDENTIAL_ID_AS_GENERATED>:<SERVICE_ID_AS_GENERATED>::"
private static String COS_BUCKET_LOCATION = "<location>"; // eg "us"

public static void main(String[] args)
{
SDKGlobalConfiguration.IAM_ENDPOINT = COS_AUTH_ENDPOINT;

try {
_cos = createClient(COS_API_KEY_ID, COS_SERVICE_CRN, COS_ENDPOINT, COS_BUCKET_LOCATION);
} catch (SdkClientException sdke) {
System.out.printf("SDK Error: %sn", sdke.getMessage());
} catch (Exception e) {
System.out.printf("Error: %sn", e.getMessage());
}
}

public static AmazonS3 createClient(String api_key, String service_instance_id, String endpoint_url, String location)
{
AWSCredentials credentials = new BasicIBMOAuthCredentials(api_key, service_instance_id);
ClientConfiguration clientConfig = new ClientConfiguration().withRequestTimeout(5000);
clientConfig.setUseTcpKeepAlive(true);

AmazonS3 cos = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(credentials))
.withEndpointConfiguration(new EndpointConfiguration(endpoint_url, location)).withPathStyleAccessEnabled(true)
vault write [-format=FORMAT] ibmcloud/SECRET_TYPE/roles/groups/SECRET_GROUP_ID/ROLE_ID/metadata [name="ROLE_NAME"] [access_groups=ACCESS_GROUP_ID,ACCESS_GROUP_ID] [ttl=LEASE_DURATION] [description="DESCRIPTION"] [labels=LABEL,LABEL]



 Prerequisites 

You need the [Writer service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to update the metadata of a secret.





 Command options 

SECRET_TYPE
: The type of secret that you want to update. Currently, iam_credentials is supported.

SECRET_GROUP_ID
: The ID of the secret group that is assigned to the role and its credentials.

ROLE_ID
: The ID that assigned to this secret.

access_groups
: The ID of the access group that determines the scope of access to assign to the role and its credentials.

ttl
: The time-to-live (TTL) that determines how long a role's generated credentials can exist. Use a duration string such as 300s or 1h30m. Valid time units are s, m, and h.

name
: The new name that you want to assign for this secret.

description
: An extended description to assign to the role and its credentials.

labels
: Labels that you can use to group and search for similar secrets in your instance.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

Update the details of a role that is assigned to the default group.

vault write -format=json ibmcloud/iam_credentials/roles/091ca93f-5c99-4078-9d7e-4801143030fd/metadata name="new-credential-name"





 Output 

The command returns the following output:

{
Setting up client-to-site authentication 

Configure your authentication settings for the VPN server and VPN clients. Certificates are managed through IBM Cloud® Secrets Manager.



 Creating an IAM service-to-service authorization 

To create an IAM service-to-service authorization for your VPN server and IBM Cloud Secrets Manager, follow these steps:

You can also set up IAM service-to-service authorization on the VPN server provisioning page, or use the Edit authorization side panel.



1. From the IBM Cloud console, go to the [Manage authorizations](https://cloud.ibm.com/iam/authorizations) page and click Create.
2. Select VPC Infrastructure Services from the menu. Then, select Resource based on selected attributes.
3. Select Resource type > Client VPN for VPC.
4. For Target service, select Secrets Manager.
5. Keep All resources selected. Then, select the SecretsReader checkbox.
6. Click Authorize.







 Managing VPN server and client certificates 



 Importing a certificate into Secrets Manager 

The following procedure uses [OpenVPN easy-rsa](https://github.com/OpenVPN/easy-rsa) to generate the VPN server and client certificates, and then imports these certificates to Secrets Manager. For more information, see the [Easy-RSA 3 Quickstart README](https://github.com/OpenVPN/easy-rsa/blob/master/README.quickstart.md).



1. Clone the Easy-RSA 3 repository into your local folder:

git clone https://github.com/OpenVPN/easy-rsa.git
cd easy-rsa/easyrsa3
2. Create a Public Key Infrastructure (PKI) and Certificate Authority (CA):

./easyrsa init-pki
./easyrsa build-ca nopass

Check that the CA certificate is generated at path ./pki/ca.crt.
3. Generate a VPN server certificate:
apikey New API key that is created for the Service ID 
 cos_hmac_keys Access Key and Secret Key pair for use with S3-compatible tools and libraries 
 endpoints Link to JSON representation of available endpoints 
 iam_apikey_description API key description - initially generated but editable 
 iam_apikey_name API key name - initially generated but editable 
 iam_role_crn Unique identifier for the assigned role 
 iam_serviceid_crn Unique identifier for the Service ID 
 resource_instance_id Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential. 
 This is an example of a service credential: 



{
"apikey": "0viPHOY7LbLNa9eLftrtHPpTjoGv6hbLD1QalRXikliJ",
"cos_hmac_keys": {
"access_key_id": "347aa3a4b34344f8bc7c7cccdf856e4c",
"secret_access_key": "gvurfb82712ad14W7a7915h763a6i87155d30a1234364f61"
},
"endpoints": "https://control.cloud-object-storage.test.cloud.ibm.com/v2/endpoints",
"iam_apikey_description": "Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloud-object-storage:global:a/3ag0e9402tyfd5d29761c3e97696b71n:d6f74k03-6k4f-4a82-b165-697354o63903::",
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2020-10-20T16:55:41Z",
"id": "cc2c795e-0072-8074-9824-b6efd5050232"
}
]
},
"warnings": null
}







 Update a secret 

Use this command to update the metadata of a secret, such as its name or description. Allowable values for SECRET_TYPE are: arbitrary, iam_credentials, imported_cert, kv, private_cert, public_cert, and username_password.

vault write [-format=FORMAT] ibmcloud/SECRET_TYPE/secrets/SECRET_ID/metadata name=NAME [description="DESCRIPTION"] [labels=LABEL,LABEL]



 Prerequisites 

You need the [Writer service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to update secrets.





 Command options 

name
: The human-readable alias that you want to assign to the secret.

description
: An extended description to assign to the secret.

expiration_date
: The expiration date that you want to assign to the secret. The date format follows [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339).

labels
: Labels that you can use to group and search for similar secrets in your instance.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

Update the name of an arbitrary secret.