Longer answer: You have quite a few changes here, you may want to spend some planning time to review all the changes both at OS level and Vault level ( PKI had a big transition at vault 1.11 ), and if you stay with Consul, they have changes as well.
Doing all of this in one step will have significant risk.