Unable to rotate Consul CA


For the first time when I deployed the consul CA it works fine.

the second time I try to rotate it. It does not work. It gives below error

rpc error making call: error generating CA certificate: x509: requested SignatureAlgorithm does not match private key type

This hinders CA rotation as expiration time nears

Why does this happen? Can someone provide an insight as to what is happening here ?

Version of consul : 1.9.3

Signer is Vault (Intermediate , key type : RSA )

Consul CA (key type : EC ) is getting the CSR signed from this vault

For the first time default consul CA is able to rotate the signed consul CA from vault. When further rotation is applied it gives above error.

@blake do we have any resolution to this issue ?

Can please anyone enlighten here ?