Hi, we’ve been using Consul Connect with Vault as an external CA, and have provided Consul servers with a periodic token to manage the PKI endpoints completely with the permissions specified in the docs. However on Saturday, the root CA in Vault seems to have expired without Consul replacing or ren…

Hi, thank you for the docs. We’ve been trying to use the rotation process via consul connect ca set-config command, just changing to a new Vault root endpoint with a different name. We see the CA roots update in Consul and existing proxies work fine, however any new proxies we start will error out …

Hmm it could be. Would you mind creating an issue in hashicorp/consul-helm with some reproduction steps and we can confirm there?

We actually resolved this issue by upgrading from 1.9.6 to 1.9.8, this thread here covers the details: Secondary Datacenter can't load trusted CA certs after Rotation (Vault CA) · Issue #10682 · hashicorp/consul · GitHub Thanks for your help

Consul Connect Root CA rotation process

Consul

ishustava1 July 20, 2021, 7:28pm 2

Hey @sgtang

We support gradually rotating root CA with Vault. These docs describe the process.

Topic		Replies	Views
Connect CA rotation issue with both Vault CA provider and Built-in CA Consul	0	335	January 4, 2021
Root certificate rotation ends up in "x509: certificate has expired or is not yet valid" Consul	0	3245	March 3, 2021
Consul Connect CA w/ Vault Consul	4	1299	January 14, 2021
Consul service mesh certification authority - build-in Consul	3	94	January 12, 2026
Vault as Connect CA Error intermediate expired: certificate expired Consul connect , vault , consul-vault	0	579	August 26, 2022

Consul Connect Root CA rotation process

Related topics