Error starting agent: AutoEncrypt failed: unknown private key type requested: on autoencrypt enabled client

[nagraskal]

When enabling autoencrypt on 1.6.0rc1 client with
"auto_encrypt": {
"tls": true
}
I get
Error starting agent: AutoEncrypt failed: unknown private key type requested: (without a type...)
Same configuration works on 1.5.3.
seems like the client agent never tries to reach out to a consul server node at all.
There is no option mentioned in the documentation to set the key type.

[hanshasselberg]

Thanks for reporting @nagraskal! This is clearly a bug and I will look into it!

[nagraskal]

great, thanks!

[luanbon]

I am deploy a new server cluster with 1.6.0 and i am facing the same problem..

[ericbrumfield]

I'm getting the same error with a new agent running in client mode using consul v1.6.0 on rhel 8. The rest of our test cluster has other consul agents running in client and server mode that are working in windows server with a similar config and those are all running consul v1.5.3.

Downgraded consul in the rhel 8 box back to 1.5.3 for consistency and this error when away on the client/agent side for me.

[hanshasselberg]

Yes it is a known problem and will be fixed in the next release. Thanks for reporting!

[tradel]

Hi @nagraskal @ericbrumfield. Until we cut the next release including the fix in #6392, there is an undocumented workaround you can try. Just add the following to the configuration on the client:

"connect": {
  "enabled": true, 
  "ca_config": {
    "private_key_type": "ec",
    "private_key_bits": 256
  }
}

I have tested this with the 1.6.0 GA release.

[nagraskal]

thank you @tradel for the workaround, but isn't the connect stanza meant to be in the server config and not the client config?

I use vault as certificate backend, and if I add this stanza to the client configuration, the client connects, but there are no certificates generated in vault - I am not sure what happens here - does consul use the internal ca?

and btw., if consul generates the ca and intermediate ca pki in vault, the leaf-cert role is configured to generate rsa keys with 2048 bits, so not matching the configuration options.

I did try with the rc.

thanks!