Consul Connect and Envoy Proxy mTLS Interoperability After Certificate Rotation

Consul Connect and Envoy Proxy mTLS Interoperability After Certificate Rotation

Consul Connect automatically manages mTLS certificates through its internal CA, distributing rotated certificates to Envoy sidecars for service-to-service encryption. The certificate rotation process involves Consul generating new leaf certificates and updating the Connect CA bundle, which Envoy proxies must then reload to maintain encrypted communication.

However, the timing and mechanism of certificate propagation between Consul agents and Envoy sidecars varies across Consul versions. In some configurations, Envoy may cache certificates beyond their validity period, causing connection failures when applications attempt to communicate with newly rotated certificates. The Connect intention system continues to enforce authorization policies during rotation, but mismatched certificate states between proxy and server can create transient communication gaps.

The integration boundary between Consul's certificate lifecycle management and Envoy's secret discovery service (SDS) implementation requires careful coordination. Applications relying on long-lived connections may experience unexpected disruptions if the rotation timing is not properly synchronized with connection lifecycle management.

Which Consul and Envoy version combinations ensure seamless certificate rotation without service disruption, and how can the SDS update timing be verified to prevent connection failures during the rotation window?