Consul service mesh certification authority - build-in

Consul
1

i am using service mesh with
{
connect: enable
}

but did not configure connect.privateKey, connect.RootCert

then , consul will automatically that values
so when i call “curl http://127.0.0.1:8500/v1/connect/ca/roots”
i got some info like this

{
  "ActiveRootID": "",
  "TrustDomain": "l",
  "Roots": [
    {
      "NotBefore": "2023-06-07T22:42:49Z",
      "NotAfter": "2033-06-04T22:42:49Z",
      "RootCert": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n"
    }
  ]
}

i am wondering,
before NotAfter period, consul connect will regenerate rootCert?

do you know the answer?

1 Like
2

I have the exact same question. The root certificate was autogenerated by Consul, so it stands to reason that Consul might autogenerate a new one at some point.

The documentation has a section on Root Certificate Rotation and that a new root certificate is added - when switching CA Providers. What if I just continue on with the built-in CA?

3

Hi @madsboddum,

Consul will generate a new CA take care of the rotation seamlessly without affecting the applications running inside the mesh.

1 Like
4

Ok, that’s good to know. Thanks!