# Vault v1.21.2 DR update-primary fails (500): x509 unknown authority during token unwrap

**URL:** <https://discuss.hashicorp.com/t/vault-v1-21-2-dr-update-primary-fails-500-x509-unknown-authority-during-token-unwrap/77613>\
**Category:** Vault\
**Tags:** vault\
**Created:** [July 30, 2026, 3:31am UTC](https://discuss.hashicorp.com/t/vault-v1-21-2-dr-update-primary-fails-500-x509-unknown-authority-during-token-unwrap/77613 "2026-07-30T03:31:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunny.kumar](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sunny.kumar/32/44076_2.png) [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\
**Post date:** [July 30, 2026, 3:31am UTC](https://discuss.hashicorp.com/t/vault-v1-21-2-dr-update-primary-fails-500-x509-unknown-authority-during-token-unwrap/77613/1 "2026-07-30T03:31:15Z")

</div>

**Vault Version:** Vault Enterprise v1.21.2

**Issue Summary:** We are attempting to perform a DR failback operation to demote our DC cluster to secondary using the `sys/replication/dr/secondary/update-primary` command.

**Exact Error Output:**

Plaintext

URL: PUT [https://192.168.152.165:8200/v1/sys/replication/dr/secondary/update-primary](https://192.168.152.165:8200/v1/sys/replication/dr/secondary/update-primary)  
Code: 500. Errors:

\* error unwrapping secondary token: Post “[https://HVAULTDRAPP2:8200/v1/sys/wrapping/unwrap](https://HVAULTDRAPP2:8200/v1/sys/wrapping/unwrap)”: tls: failed to verify certificate: x509: certificate signed by unknown authority

**Troubleshooting Already Performed:**

1. **Certificate Validity:** We have verified that the DR server presents the complete certificate chain, and the SAN correctly matches `HVAULTDRAPP2`. Both clusters use the exact same Root CA.

2. **CLI Parameter:** We passed `primary_ca_file="/vault/vault.d/tls/vault-ca.crt"` in the CLI command  
**Service Restarts:** Vault services on old DC nodes have been cleanly restarted with no change in behavior.  
please help me with the solution

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [August 2, 2026, 3:37pm UTC](https://discuss.hashicorp.com/t/vault-v1-21-2-dr-update-primary-fails-500-x509-unknown-authority-during-token-unwrap/77613/2 "2026-08-02T15:37:12Z")

</div>

I would suggest opening a support ticket, since you confirmed the cert chain is in fact correct.

---

<div class="post-metadata">

**Author:** ![sunny.kumar](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sunny.kumar/32/44076_2.png) [@sunny.kumar](https://discuss.hashicorp.com/u/sunny.kumar)\
**Post date:** [August 3, 2026, 7:14am UTC](https://discuss.hashicorp.com/t/vault-v1-21-2-dr-update-primary-fails-500-x509-unknown-authority-during-token-unwrap/77613/3 "2026-08-03T07:14:41Z")

</div>

We reran the `update-primary` command using the **`ca_file`** parameter instead of **`primary_ca_file`** , as recommended, and the operation completed successfully.