nomad
nomad copied to clipboard
Nomad should accept multiple consul certificate authorities ca_file or ca_path
When configuring SSL with consul, it is possible to specify a CA path containing multiple CA certificates instead of just a single CA file. it's the ca_path
directive (as opposed to ca_file
).
This can allow graceful renewal of CA certificates. When the first CA is nearing its end of life, a new CA certificate is generated and added to that directory. Then all consul clients and servers should be updated to change their certificates to use a certificate signed with the new CA. because both CA are accepted, it makes no problem.
Nomad however doesn't have the ability, as a consul client, to specify multiple consul CA. For graceful migration, it should be possible to allow that.