Feature deprecation FAQ

This page provides frequently asked questions concerning decisions made about Vault feature deprecations. If you are looking for information about Vault licensing, refer to the Licensing FAQ page. Pleaser refer to the Feature Deprecation Notice and Plans document for up-to-date information on Vault feature deprecations and notice.

Q: What is the impact on anyone using the legacy MFA feature?
Q: I'm currently using the Etcd storage backend feature. How does the deprecation impact me?
Q: What should I do if I use Mount Filters, AppID, or any of the standalone DB engines?
Q: What is the impact of removing support for X.509 certificates with signatures that use SHA-1?

Q: what is the impact on anyone using the legacy MFA feature?

If you are an Enterprise Vault user, there is no impact. There are no changes to the Enterprise MFA offering.

If you are an OSS user and use the legacy MFA, this will impact you since we plan to deprecate the legacy MFA feature. However, while we will continue to provide support for MFA in Vault OSS in the upcoming Vault 1.10 release, our target is to remove the legacy MFA feature from the product in the following Vault 1.11 release. Therefore, you should plan to migrate to the new MFA feature when Vault OSS supports it.

Q: i'm currently using the etcd storage backend feature. how does the deprecation impact me?

The Etcd v2 has been deprecated with the release of Etcd v3.5 and will be decommissioned by Etcd v3.6. Etcd v2 API will be removed in Vault 1.10. The Etcd storage backend users should migrate Vault storage to an Etcd V3 cluster before upgrading to Vault 1.10. We recommend that you back up all storage migrations before upgrading.

If you are an Enterprise user, we recommend that you consider migrating to HashiCorp supported storage backends: Integrated Storage or Consul (if your use case requires you to use this). Your HashiCorp sales or support representative can assist you with this decision.

Q: what should i do if i use mount filters, AppID, or any of the standalone DB engines?

These features were deprecated in prior releases of Vault. We are targeting the removal of these features from the product in the Vault 1.11 release. Please plan to upgrade to these features before the release of Vault 1.11. Refer to the table below for a list of alternative features.

Deprecated Feature	Alternative Feature
Mount Filters	Path Filters
AppID	AppRole auth method
Standalone DB engines	Combined DB engines

Q: what is the impact of removing support for x.509 certificates with signatures that use SHA-1?

Starting with Vault 1.12.0, Vault will be built with Go 1.18 or later. The standard library in Go 1.18 and later rejects X.509 signatures that use a SHA-1 hash.

If this issue impacts your usage of Vault, you can temporarily work around it by deploying Vault with the environment variable GODEBUG=x509sha1=1 set. This workaround will fail in a future version of Go, however, the Go team has not said when they will remove this workaround.

If you want to check whether a certificate or CA contains a problematic signature, you can use the OpenSSL CLI:

$ openssl x509 -text -noout -in somecert.pem | grep sha1

    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Any signature algorithms that contain sha1 will be potentially problematic.

Here are the use cases that may still use certificates with SHA-1:

Auth methods

AWS Auth Method: AWS can use SHA-1-based PKCS7 signatures for DSA key pairs.
Cloud Foundry (CF) Auth Method
Kerberos Auth Method
Kubernetes Auth Method
LDAP Auth Method
JWT/OIDC Auth Method
TLS Certificates Auth Method