{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/378","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/378/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/378/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/378/events","html_url":"https://github.com/hashicorp/vault/issues/378","id":91609294,"number":378,"title":"Allow specifying CA Cert used to talk to Consul for storage backend","user":{"login":"dkaffee92","id":13087480,"avatar_url":"https://avatars.githubusercontent.com/u/13087480?v=3","gravatar_id":"","url":"https://api.github.com/users/dkaffee92","html_url":"https://github.com/dkaffee92","followers_url":"https://api.github.com/users/dkaffee92/followers","following_url":"https://api.github.com/users/dkaffee92/following{/other_user}","gists_url":"https://api.github.com/users/dkaffee92/gists{/gist_id}","starred_url":"https://api.github.com/users/dkaffee92/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkaffee92/subscriptions","organizations_url":"https://api.github.com/users/dkaffee92/orgs","repos_url":"https://api.github.com/users/dkaffee92/repos","events_url":"https://api.github.com/users/dkaffee92/events{/privacy}","received_events_url":"https://api.github.com/users/dkaffee92/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/vault/labels/enhancement","name":"enhancement","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-28T15:28:00Z","updated_at":"2015-07-01T06:55:43Z","closed_at":null,"body":"Hey guys,\r\n\r\nUsing release v0.1.2\r\n\r\nThere is no way to specify the use of a custom self signed ca certificate for the communication with a consul server.\r\n\r\nI've set up a consul server and a vault server using a self signed ca.\r\n\r\n```json\r\n# consul configuration\r\n{\r\n  \"disable_remote_exec\": true,\r\n  \"disable_update_check\": true,\r\n  \"domain\": \"consul.\",\r\n  \"data_dir\": \"/opt/consul/data\",\r\n  \"log_level\": \"INFO\",\r\n  \"enable_syslog\": true,\r\n  \"client_addr\": \"127.0.0.1\",\r\n  \"bind_addr\": \"0.0.0.0\",\r\n  \"datacenter\": \"example-dc\",\r\n  \"ports\": {\r\n    \"dns\":  -1,\r\n    \"https\": 8500,\r\n    \"http\":  -1   },\r\n  \"encrypt\": \"< some encryption key >\",\r\n  \"ca_file\": \"ca.crt\",\r\n  \"cert_file\": \"internal.crt\",\r\n  \"key_file\": \"internal.key\",\r\n  \"verify_incoming\": true,\r\n  \"verify_outgoing\": true\r\n}\r\n```\r\n\r\n```shell\r\n# vault configuration\r\nbackend \"consul\" {\r\n  address = \"consul.example.com:8500\"\r\n  advertise_addr = \"https://127.0.0.1:8200\"\r\n  path = \"vault/\"\r\n  scheme = \"https\"\r\n  token = \"< some token >\"\r\n}\r\n\r\nlistener \"tcp\" {\r\n  address = \"127.0.0.1:8200\"\r\n  tls_cert_file = \"internal.crt\"\r\n  tls_key_file = \"internal.key\"\r\n}\r\n```\r\n\r\nstarting the servers:\r\n\r\n```shell\r\n# vault\r\n==> Vault server configuration:\r\n\r\n         Log Level: info\r\n             Mlock: supported: true, enabled: true\r\n           Backend: consul (HA available)\r\n Advertise Address: https://127.0.0.1:8200\r\n        Listener 1: tcp (addr: \"127.0.0.1:8200\", tls: \"enabled\")\r\n\r\n==> Vault server started! Log data will stream in below:\r\n```\r\n\r\n```shell\r\n# consul\r\n==> Starting Consul agent...\r\n==> Starting Consul agent RPC...\r\n==> Joining cluster...\r\n    Join completed. Synced with 1 initial agents\r\n==> Consul agent running!\r\n         Node name: 'test.01'\r\n        Datacenter: 'example-dc'\r\n            Server: false (bootstrap: false)\r\n       Client Addr: 127.0.0.1 (HTTP: -1, HTTPS: 8500, DNS: -1, RPC: 8400)\r\n      Cluster Addr: 172.31.1.1 (LAN: 8301, WAN: 8302)\r\n    Gossip encrypt: true, RPC-TLS: true, TLS-Incoming: true\r\n             Atlas: <disabled>\r\n```\r\n\r\nand when I try to init and unseal the vault server this is what I get\r\n\r\n```shell\r\n$ vault init\r\n[ERR] core: failed to read seal configuration: Get https://consul.example.com:8500/v1/kv/vault/core/seal-config?token=< some token >: x509: certificate signed by unknown authority\r\n```\r\n\r\nAccessing consul directly through curl and specifying the keys does work,\r\n```shell\r\ncurl --key internal.key --cert internal.cert --cacert ca.cert https://consul.example.com:8500/v1/kv/vault/barrier/init?token=< some token >\r\n\r\n Hostname was NOT found in DNS cache\r\n*   Trying 172.31.1.1...\r\n* Connected to consul.example.com (172.31.1.1) port 8500 (#0)\r\n* successfully set certificate verify locations:\r\n*   CAfile: /etc/example/ssl/ca.cert\r\n  CApath: /etc/ssl/certs\r\n* SSLv3, TLS handshake, Client hello (1):\r\n* SSLv3, TLS handshake, Server hello (2):\r\n* SSLv3, TLS handshake, CERT (11):\r\n* SSLv3, TLS handshake, Server key exchange (12):\r\n* SSLv3, TLS handshake, Request CERT (13):\r\n* SSLv3, TLS handshake, Server finished (14):\r\n* SSLv3, TLS handshake, CERT (11):\r\n* SSLv3, TLS handshake, Client key exchange (16):\r\n* SSLv3, TLS handshake, CERT verify (15):\r\n* SSLv3, TLS change cipher, Client hello (1):\r\n* SSLv3, TLS handshake, Finished (20):\r\n* SSLv3, TLS change cipher, Client hello (1):\r\n* SSLv3, TLS handshake, Finished (20):\r\n* SSL connection using ECDHE-RSA-AES256-SHA\r\n* Server certificate:\r\n* \t subject: CN=example.com; ST=NY; C=US; O=Example Inc.; OU=Engineering\r\n* \t start date: 2015-06-28 11:38:02 GMT\r\n* \t expire date: 2025-06-25 11:38:02 GMT\r\n* \t subjectAltName: consul.example.com matched\r\n* \t issuer: C=AU; ST=Some-State; O=Example; CN=ExampleCA; emailAddress=admin@example.com\r\n* \t SSL certificate verify ok.\r\n> GET /v1/kv/vault/barrier/init?token=< some token > HTTP/1.1\r\n> User-Agent: curl/7.35.0\r\n> Host: consul.example.com:8500\r\n> Accept: */*\r\n>\r\n< HTTP/1.1 404 Not Found\r\n< X-Consul-Index: 148303\r\n< X-Consul-Knownleader: true\r\n< X-Consul-Lastcontact: 0\r\n< Date: Sun, 28 Jun 2015 15:17:21 GMT\r\n< Content-Length: 0\r\n< Content-Type: text/plain; charset=utf-8\r\n<\r\n* Connection #0 to host consul.example.com left intact\r\n```"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/117486123","html_url":"https://github.com/hashicorp/vault/issues/378#issuecomment-117486123","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/378","id":117486123,"user":{"login":"dkaffee92","id":13087480,"avatar_url":"https://avatars.githubusercontent.com/u/13087480?v=3","gravatar_id":"","url":"https://api.github.com/users/dkaffee92","html_url":"https://github.com/dkaffee92","followers_url":"https://api.github.com/users/dkaffee92/followers","following_url":"https://api.github.com/users/dkaffee92/following{/other_user}","gists_url":"https://api.github.com/users/dkaffee92/gists{/gist_id}","starred_url":"https://api.github.com/users/dkaffee92/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkaffee92/subscriptions","organizations_url":"https://api.github.com/users/dkaffee92/orgs","repos_url":"https://api.github.com/users/dkaffee92/repos","events_url":"https://api.github.com/users/dkaffee92/events{/privacy}","received_events_url":"https://api.github.com/users/dkaffee92/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T06:55:43Z","updated_at":"2015-07-01T06:55:43Z","body":"@armon I created a branch, will tidy it up a little bit and send a pull request."}}