@James78 I just ran into the same issue with a Nomad envoy sidecar.
This seems to be the problem: `verify_outgoing` not supported on gRPC listener; `verify_incoming` breaks Consul Connect envoy sidecars · Issue #13088 · hashicorp/consul · GitHub
This problem was introduced with 1.12.x when setting tls.defaults.verify_incoming = true.
The current “workaround” (return to pre 1.12.x behaviour), is to set tls.grpc.verify_incoming = false.