Add TLSConfig for the Vault CA Provider

[ole-lukoe]

Hello!
There is only Address option in Vault CA provider configuration endpoint. As I can see, when https:// Vault URI used, vaultAPI is trying to establish connection using default http.Client structure. Since our Vault cluster checks clients certificates, I wish to specify certificates for Consul to connect to Vault.
Do you plan to add this feature in next releases?
Thanks in advance.

[banks]

Hey,

Yep you right, thanks for filing this - we'll need to add a way to specify client certificates.

Do you need to use a specific certificate (i.e. different identity/CA from the Consul server's TLS certificate) or would it be enough to just present the server's TLS certificate if one is set?

[ole-lukoe]

Thank you for the answer. As for me, I think the easiest way is to add three fields like ca_file, key_file, cert_file or so. It will allow to use third-party certificates for communication with Vault. It will also allow to set same certificate files on which Consul communication built (if used) and I would prefer this way to inform provider about my needs.

[rkettelerij]

The Consul Connect docs currently use `http://localhost:8200' as an example when talking about Vault as a Connect CA. This isn't a proper example since it is highly discouraged to run Vault without TLS. So in order to use Vault realistically as a CA with Connect you'll really need - as already discussed - the following options (from https://www.nomadproject.io/docs/configuration/vault.html):

• ca_file (string: "") - Specifies an optional path to the CA certificate used for Vault communication. If unspecified, this will fallback to the default system CA bundle, which varies by OS and version.

• ca_path (string: "") - Specifies an optional path to a folder containing CA certificates to be used for Vault communication. If unspecified, this will fallback to the default system CA bundle, which varies by OS and version.

• cert_file (string: "") - Specifies the path to the certificate used for Vault communication. If this is set then you need to also set tls_key_file.

• key_file (string: "") - Specifies the path to the private key used for Vault communication. If this is set then you need to also set cert_file.

• tls_server_name (string: "") - Specifies an optional string used to set the SNI host when connecting to Vault via TLS.

• tls_skip_verify (bool: false) - Specifies if SSL peer validation should be enforced.

[banks]

Thanks @rkettelerij!

You are quite right and it makes perfect sense to use the same config options nomad does.

@kyhavlov FYI seems like an important one to get in this cycle.