Vault v1.21.2 DR update-primary fails (500): x509 unknown authority during token unwrap

Vault
1

Vault Version: Vault Enterprise v1.21.2

Issue Summary: We are attempting to perform a DR failback operation to demote our DC cluster to secondary using the sys/replication/dr/secondary/update-primary command.

Exact Error Output:

Plaintext

URL: PUT https://192.168.152.165:8200/v1/sys/replication/dr/secondary/update-primary
Code: 500. Errors:

* error unwrapping secondary token: Post “https://HVAULTDRAPP2:8200/v1/sys/wrapping/unwrap”: tls: failed to verify certificate: x509: certificate signed by unknown authority

Troubleshooting Already Performed:

  1. Certificate Validity: We have verified that the DR server presents the complete certificate chain, and the SAN correctly matches HVAULTDRAPP2. Both clusters use the exact same Root CA.

  2. CLI Parameter: We passed primary_ca_file="/vault/vault.d/tls/vault-ca.crt" in the CLI command
    Service Restarts: Vault services on old DC nodes have been cleanly restarted with no change in behavior.
    please help me with the solution

2

I would suggest opening a support ticket, since you confirmed the cert chain is in fact correct.

3

We reran the update-primary command using the ca_file parameter instead of primary_ca_file, as recommended, and the operation completed successfully.

1 Like