# Consul Connect Root CA rotation process

**URL:** <https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994>\
**Category:** Consul\
**Created:** [July 19, 2021, 7:31pm UTC](https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994 "2021-07-19T19:31:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sgtang](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sgtang/32/20275_2.png) [@sgtang](https://discuss.hashicorp.com/u/sgtang)\
**Post date:** [July 19, 2021, 7:31pm UTC](https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994/1 "2021-07-19T19:31:41Z")

</div>

Hi, we’ve been using Consul Connect with Vault as an external CA, and have provided Consul servers with a periodic token to manage the PKI endpoints completely with the permissions specified in the docs.

However on Saturday, the root CA in Vault seems to have expired without Consul replacing or renewing it properly.

My question is whether Consul is supposed to handle this process or if we’re expected to provide a new PKI endpoint before the root expires?

---

<div class="post-metadata">

**Author:** ![ishustava1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ishustava1/32/16543_2.png) [@ishustava1](https://discuss.hashicorp.com/u/ishustava1)\
**Post date:** [July 20, 2021, 7:28pm UTC](https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994/2 "2021-07-20T19:28:27Z")

</div>

Hey @sgtang

We support gradually rotating root CA with Vault. [These docs](https://www.consul.io/docs/connect/ca#root-certificate-rotation) describe the process.

---

<div class="post-metadata">

**Author:** ![sgtang](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sgtang/32/20275_2.png) [@sgtang](https://discuss.hashicorp.com/u/sgtang)\
**Post date:** [July 22, 2021, 7:07pm UTC](https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994/3 "2021-07-22T19:07:13Z")

</div>

Hi, thank you for the docs. We’ve been trying to use the rotation process via consul connect ca set-config command, just changing to a new Vault root endpoint with a different name.

We see the CA roots update in Consul and existing proxies work fine, however any new proxies we start will error out with "Failed to load trusted CA certificates from " until we specifically restart the Consul leader and an election is forced.

I haven’t found any docs/issues regarding this behavior. It seems like a bug but we’re not entirely sure. Are we implementing this incorrectly?

---

<div class="post-metadata">

**Author:** ![ishustava1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ishustava1/32/16543_2.png) [@ishustava1](https://discuss.hashicorp.com/u/ishustava1)\
**Post date:** [July 22, 2021, 8:14pm UTC](https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994/4 "2021-07-22T20:14:41Z")

</div>

Hmm it could be. Would you mind creating an issue in hashicorp/consul-helm with some reproduction steps and we can confirm there?

---

<div class="post-metadata">

**Author:** ![sgtang](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sgtang/32/20275_2.png) [@sgtang](https://discuss.hashicorp.com/u/sgtang)\
**Post date:** [July 23, 2021, 8:36pm UTC](https://discuss.hashicorp.com/t/consul-connect-root-ca-rotation-process/26994/5 "2021-07-23T20:36:00Z")

</div>

We actually resolved this issue by upgrading from 1.9.6 to 1.9.8, this thread here covers the details: [Secondary Datacenter can't load trusted CA certs after Rotation (Vault CA) · Issue #10682 · hashicorp/consul · GitHub](https://github.com/hashicorp/consul/issues/10682)

Thanks for your help