Question 1

Requests fail because OpenBao is sealed (HTTP 503) after a restart or reboot

Accepted Answer

Check: bao status → Sealed true. Fix: Expected with a Shamir seal: sudo openbao-unseal, or bao operator unseal with three keys. For unattended restarts, set up Cloud KMS auto-unseal.

Question 2

bao status: connection refused or certificate errors

Accepted Answer

Check: echo $BAO_ADDR $BAO_CACERT. Fix: Non-login shells skip /etc/profile.d: run source /etc/profile.d/openbao.sh (BAO_ADDR=https://127.0.0.1:8200, BAO_CACERT=/etc/openbao/tls/tls.crt).

Question 3

openbao-unseal: cannot read /root/openbao-init.json

Accepted Answer

Check: Has the init file been moved off the VM?. Fix: Pass its path (sudo openbao-unseal /path/to/init.json) or unseal with bao operator unseal and three keys from your store.

Question 4

openbao.service won't start

Accepted Answer

Check: journalctl -u openbao -n 50. Fix: Check the openbao.hcl syntax and that /etc/openbao/tls/tls.crt and tls.key exist and are readable by the openbao group.

Troubleshoot DCA Hardened Secrets Manager — for OpenBao™

Logs & useful commands

Symptom	Check	Fix
Requests fail because OpenBao is sealed (HTTP 503) after a restart or reboot	bao status → Sealed true	Expected with a Shamir seal: sudo openbao-unseal, or bao operator unseal with three keys. For unattended restarts, set up Cloud KMS auto-unseal.
bao status: connection refused or certificate errors	echo $BAO_ADDR $BAO_CACERT	Non-login shells skip /etc/profile.d: run source /etc/profile.d/openbao.sh (BAO_ADDR=https://127.0.0.1:8200, BAO_CACERT=/etc/openbao/tls/tls.crt).
openbao-unseal: cannot read /root/openbao-init.json	Has the init file been moved off the VM?	Pass its path (sudo openbao-unseal /path/to/init.json) or unseal with bao operator unseal and three keys from your store.
openbao.service won't start	journalctl -u openbao -n 50	Check the openbao.hcl syntax and that /etc/openbao/tls/tls.crt and tls.key exist and are readable by the openbao group.