Say one has a service provided by Consul, for which
active.[name-of-service].service.consul is the link it provides to the active host leader for that service. How would I properly set up TLS to that
.consul domain name?
For example, suppose I have a HashiCorp Vault service, for which HashiCorp Consul provides service discovery with the HashiCorp Consul DNS interface by
active.vault.service.consul. If more
I've heard that the "-domain" configuration option can be used to change the TLD from .consul to .somethingelse. Can it be changed to .subdomain.mymaindomain.com and have it still work w/o reaching out to corporate DNS? If so, could one potentially get a real subdomain for a consul/vault service and configure our consul DNS queries to answer under that subdomain. That would allow us to use real, trusted, TLS server certificates for securing communications.
However, without using Consul's CA feature, it seems difficult to actually set up a cert that has
active.vault.service.consul on an SAN.
Do I need to use a private CA for this?
Consul has a page on how to set up encryption with TLS, but it seems to be more for authenticating clients than for use with domain names.
Anyway, other than self-signed certificates, how does one get TLS for URIs like
https://active.vault.service.consul:8200/sys/health to work properly?