This documentation is for WSO2 Enterprise Service Bus version 4.8.1 . View documentation for the latest release.

All docs This doc

Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


By default, the ESB instance's primary key store (<ESB_HOME>/repository/resources/security/wso2carbon.jks) is used as the secure vault. If you want to use another key store or cipher text properties file, or if you want to use a custom callback class to handle decryption, modify the <ESB_HOME>/repository/conf/security/ file. For more information on configuring the secure vault and creating custom callback classes, see WSO2 Carbon Secure Vault in the Carbon documentation.

Running the cipher script

To store passwords in the secure vault, run the ciphertool script from the command line as follows:


Follow the steps below to encrypt and store new passwords via the ESB Management Console.

  1. Run the cipher script as specified above to setup the secure vault environment.
  2. Click the Main tab on the Management Console, go to Manage -> Secure Vault Tool and then click Manage Passwords. The Secure Vault Password Management screen appears.
  3. Click Add New Password to encrypt and store, and then specify values for the following fields:
    Vault Key - The alias for the password.
    Password -  The actual password.
    Re-enter password - The password that you specified as the actual password. 
    Image Modified 
    This creates a new password entry in the registry encrypted with the alias that you specified.

If you need to retrieve this password in your ESB configuration, you can use the {wso2:vault-lookup('alias')}custom path expression to logically reference the password mapping. See the next section for information on how to use an alias in your configuration.


You can encrypt and store the password with the alias AdminUser.Password, and retrieve this password in your ESB synapse configuration as follows: