Consul (ssl, with Vault CA) + Nomad (tls): Envoy proxies returns "tls: unknown certificate authority"

Consul
,
3

Hi @jsosulska

thank you (everyone) all for the help and the call too!

We proceed to try something, and we did like this, just for testing:

  1. we bootstrapped the cluster without connect enabled as you advise, and then enable it once we had all the vault certificates, this allow to see that /v1/connect/ca/configuration returned the Vault one while before was the one created by consul.

  2. now we can see another intermediate “leaf-cert” in Vault

  3. deploying the job they (the proxies) still don’t work, but appending the “new” ca roots certificate to the old one (so, one file with two certificates), restarting nomad and redeploying the nomad job we finally see the proxies working!

This method is not rock solid, we will try to follow the way you told us for the resolution, so different certs for different purposes.

I’ll keep you updated regarding this process.

Thank you

Francesco

1 Like