Is it possible to use more than one CA in Consul Connect?
We want to use a local (cluster) CA to issue certificates for some services and a global (PKI) CA to issue certificates for other services.
From the docs I couldn’t clearly figure out whenever this is possible or not (either by using Vault or any other solution).
Could you explain what you hope to achieve by this? I don’t think it’s possible right now - even with the Vault integration, Consul is just effectively creating an intermediate CA for itself and issuing all Connect certificates from there.
For a multi cluster environment we would like to use 1 local (cluster) CA to issue certificates for application that are intended to communicate only locally within this cluster and another global (PKI) CA to issue certificates for applications that are intended to communicate with applications in other clusters.