nomad icon indicating copy to clipboard operation
nomad copied to clipboard

Nomad should accept multiple consul certificate authorities ca_file or ca_path

Open mildred opened this issue 6 years ago • 1 comments

When configuring SSL with consul, it is possible to specify a CA path containing multiple CA certificates instead of just a single CA file. it's the ca_path directive (as opposed to ca_file).

This can allow graceful renewal of CA certificates. When the first CA is nearing its end of life, a new CA certificate is generated and added to that directory. Then all consul clients and servers should be updated to change their certificates to use a certificate signed with the new CA. because both CA are accepted, it makes no problem.

Nomad however doesn't have the ability, as a consul client, to specify multiple consul CA. For graceful migration, it should be possible to allow that.

mildred avatar May 14 '18 08:05 mildred