Vault Presenting Wrong TLS Cert

Vault
1

Hello,

New to vault here. I’m trying to utilize an internal ADCS services to import a signed cert into the vault. I was able to generate a CSR with the correct SAN etc, sign it with my CA and import it back along with the intermediate to the Vault.

I have my vault-server.hcl listeners pointing to the new cert and priv key. For some reason though, the vault opts to use the self signed tls.crt and key. I’ve reloaded the vault service but I can’t seem to get it to utilize this new cert. Any thoughts?

2

Can you please share your Vault config, deidentified/obfuscated from any confidential info please?

3

Sure @jonathanfrappier.

api_add = “https://X.X.X.X”
cluster_addr = “https://X.X.X.X”
cluster_name = “X”
disable_mlock = true
ui = true

listenter “tcp” {
address = “X.X.X.X”
tls_cert_file = “/path/to/file/Cert.cer”
tls_key_file = “/path/to/file/key.pem”
tls_client_ca_file = “/path/to/file/CA.cer”
tls_disable_client_certs = “true”
}

backend “raft” {
path = “X”
node_id = “X”
}