Repository navigation
Self-signed certificate is missing IPv6 SAN in dual-stack environments, breaking TLS validation #961
Description
Bug Description
When deploying the Vault charm in a dual-stack (IPv4 + IPv6) environment, Juju often selects the IPv6 address as the unit's public-address. However, the self-signed certificate generated by the Vault charm only includes the machine's IPv4 address in its Subject Alternative Names (SANs).
This causes the vault client to fail (e.g. during the unsealing process), even when VAULT_CAPATH is pointing to the self-signed certificate.
To Reproduce
- Deploy the vault charm.
- Observe via juju status that the unit is assigned an IPv6 public-address.
- From a machine with IPv6 routing, attempt to check the Vault status using the public address.
Environment
Charm: vault (machine)
Channel: 1.19/stable (Revision 677)
Juju Version: 3.6.21
Infrastructure: LXD / MicroCloud (Dual-stack IPv4/IPv6 networking)
Relevant log output
~$ juju status Model Controller Cloud/Region Version Timestamp test-is-vault-drs juju-controller-36 microcloud-drs/default 3.6.21 22:47:45Z App Version Status Scale Charm Channel Rev Exposed Message landscape-client blocked 3 landscape-client latest/edge 72 no Registration failed! ubuntu-advantage active 3 ubuntu-advantage latest/stable 143 no Attached (esm-apps,esm-infra,landscape)
vault blocked 3 vault 1.19/edge 650 yes Please initialize Vault or integrate with an auto-unseal provider
Unit Workload Agent Machine Public address Ports Message
vault/4* blocked idle 6 2a06:bc80:0:4004:216:3eff:fe7a:d720 8200/tcp Please initialize Vault or integrate with an auto-unseal provider
landscape-client/0* blocked idle 2a06:bc80:0:4004:216:3eff:fe7a:d720 Registration failed!
ubuntu-advantage/0* active idle 2a06:bc80:0:4004:216:3eff:fe7a:d720 Attached (esm-apps,esm-infra,landscape)
vault/5 blocked idle 7 2a06:bc80:0:4004:216:3eff:febc:2a0c 8200/tcp Please initialize Vault or integrate with an auto-unseal provider
landscape-client/1 blocked idle 2a06:bc80:0:4004:216:3eff:febc:2a0c Registration failed!
ubuntu-advantage/1 active idle 2a06:bc80:0:4004:216:3eff:febc:2a0c Attached (esm-apps,esm-infra,landscape)
vault/6 blocked idle 8 2a06:bc80:0:4004:216:3eff:fecf:2eee 8200/tcp Please initialize Vault or integrate with an auto-unseal provider
landscape-client/2 blocked idle 2a06:bc80:0:4004:216:3eff:fecf:2eee Registration failed!
ubuntu-advantage/2 active idle 2a06:bc80:0:4004:216:3eff:fecf:2eee Attached (esm-apps,esm-infra,landscape)
Machine State Address Inst id Base AZ Message
6 started 2a06:bc80:0:4004:216:3eff:fe7a:d720 juju-734b73-6 ubuntu@24.04 drs-is1 Running
7 started 2a06:bc80:0:4004:216:3eff:febc:2a0c juju-734b73-7 ubuntu@24.04 drs-is2 Running
8 started 2a06:bc80:0:4004:216:3eff:fecf:2eee juju-734b73-8 ubuntu@24.04 drs-is2 Running
$ export VAULT_ADDR=https://[2a06:bc80:0:4004:216:3eff:fe7a:d720]:8200
$ vault status Error checking seal status: Get "https://[2a06:bc80:0:4004:216:3eff:fe7a:d720]:8200/v1/sys/seal-status": tls: failed to verify certificate: x509: certificate is valid for 10.171.4.2, not 2a06:bc80:0:4004:216:3eff:fe7a:d720
$ export VAULT_SKIP_VERIFY=true
$ vault status Key Value --- ----- Seal Type shamir Initialized false Sealed true Total Shares 0 Threshold 0 Unseal Progress 0/0 Unseal Nonce n/a Version 1.19.5 Build Date 2025-04-23T20:01:58Z Storage Type raft HA Enabled trueAdditional context
No response
Activity