CA certificate rotation for Agent TLS

Consul
1

Hello,

I am looking for a procedure how to rotate a CA certificate and its private key for Agent TLS. I went through Consul docs and here is the best I could find:

What do we use?

  1. Consul on GKE, deployed using Consul Helm Chart 1.0.2 (This is 1.14.x Consul binary)
  2. We still use Consul Clients with auto-encrypt disabled
  3. Agent TLS is enabled, configured and we would like to rotate the CA certificate and the CA private key (we are not interested in rotating Consul Server cert and its key which is done atuomatically by the tls-init Job)

For example, Connect CA can be rotated automatically. Is there is similar procedure to rotate Consul Agent TLS?

Thanks for help in advance.

Dominik