---

title: CredHub

owner: CredHub

---

Learn about the functionality of the Cloud Foundry CredHub component.

CredHub is a component designed for centralized credential management in <%= vars.platform_name %>. It's

a single

component that can address several scenarios in the <%= vars.platform_name %> ecosystem. At the

highest level, CredHub

centralizes and secures credential generation, storage, lifecycle management, and access.

## <a id="what-can-it-do"></a> Functions

CredHub performs a number of different functions to help generate and protect the credentials in your

<%= vars.platform_name %> deployment:

* Securing data for storage

* Authentication

* [Authorization and Permissions](https://github.com/cloudfoundry-incubator/credhub/blob/main/docs/authorization-and-permissions.md)

* Access and change logging

* Data typing

* Credential generation

* Credential metadata

* Credential versioning

## <a id="application-architecture"></a> App architecture

CredHub consists of a REST API and a CLI. CredHub is an OAuth2

resource server that integrates with User Account Authentication (UAA) to provide core authentication and federation

capabilities.


<% if vars.platform_code == 'CF' %>

<%= partial './oss_credhub' %>

<% else %>

## <a id="pcfcredhub"></a> CredHub in <%= vars.platform_name %>

A <%= vars.platform_name %> deployment stores credentials in the following locations:

* **BOSH CredHub**: Colocated with the BOSH Director on a single VM. This CredHub instance stores credentials for the BOSH Director.

* **Runtime CredHub**: Deployed as an independent service and stores service instance credentials.

### <a id="bosh"></a> BOSH CredHub

In <%= vars.platform_name %>, the BOSH Director VM includes a CredHub job. This provides a lightweight credential storage instance for the BOSH Director. The BOSH Director, <%= vars.app_runtime_full %> (<%= vars.app_runtime_abbr %>), and other tiles store credentials in BOSH CredHub. For more information, see _Retrieve Credentials Stored in BOSH CredHub_ in _Retrieving Credentials from Your Deployment_.

This configuration does not provide high availability.

In this colocated deployment architecture, the BOSH Director, CredHub, UAA, and the BOSH Director database are all

installed on a single BOSH VM, as shown in the following diagram:


### <a id="runtime"></a> Runtime CredHub

The <%= vars.app_runtime_abbr %> tile deploys CredHub as an independent service on its own VM. This provides a highly available credential storage instance for securing service instance credentials.

CredHub is a stateless app, so you can scale it to multiple instances that share a common database cluster and encryption provider.

With CredHub as a service, the load balancer and external databases communicate directly with the CredHub VMs, as shown in the following diagram:


<% end %>

## <a id="cred-types"></a> CredHub credential types

Credentials exist in multiple places.

Components use credentials to authenticate connections between components.

Installations often have hundreds of active credentials.

Leaked credentials are common causes of data and security breaches, so managing them securely is very important.

For more information, see [CredHub Credential Types](credential-types.html).

## <a id="backup-restore"></a> Backing up and restoring CredHub instances

CredHub does not hold state, but you must ensure its dependent components are backed up. Redundant backups can help

prevent data loss if an individual component fails.

For more information, see

[Backing Up and Restoring CredHub Instances](backup-restore.html).