Understanding where generating fullchain.pem and privkey.pem fits into this cluster setup

Question

I used this repo https://github.com/scarolan/vault-aws-cf to generate a HashiCorp Vault and HashiCorp Consul cluster for secrets management. During the setup, it was required that the vault AMI's needed certificates, in this case a fullchain.pem and privkey.pem

What is their purpose in this setup? I generated a managed certificate for https on Amazon Web Services but want to understand the AMI server requirements for the certificates.

Answer 1

those certs are used for your https listeners, for example here.

The AWS certificates you generated through AWS ACM wont work since they are managed by AWS.

You could generated AWS certs through ACM, but you'd need access to the private key as well, for example https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-export-private.html . That means that AWS wont be able to rotate your certs and you need to do it by hand.

You could also place your Vault behind an ALB and attach the certificates you generated in the first place in that ALB. This means that your SSL is terminated at the Load balancer level and the traffic between your ALB and Vault is going to be unencrypted.