KV Certificate
Configure KV Certificate to receive renewed certificates automatically.
1. Overview
A HashiCorp Consul - KV Certificate node deploys certificates to this configured target.
2. Configuration
Select this platform and deployment position, then supply the following parameters.
| Field | Required | Description |
|---|---|---|
| API URL | Yes | https://consul.example.com |
| API Token | Yes | |
| KV Prefix | Yes | certificates |
| Certificate Directory | Yes | |
| Verify TLS Certificate | Yes | Yes (recommended) / No (self-signed server certificate); default: true |
3. Deployment and renewal
- Use an ACL token with token self-read and key write permissions under this prefix. Atomically writes cert.pem, cert.key, chain.pem and fullchain.pem under prefix/domain. Consumers must watch or reload these keys.
Associate the certificate with the node and enable automatic deployment on renewal. Certificate replacement uses the same configured target on every run.
The endpoint must use HTTPS and be reachable from the CertOne deployment service. TLS certificate verification is enabled by default. Disable verification only when the target has a self-signed certificate and its address is trusted.
All four keys are replaced in a single transaction. An ACL token needs write permission for every key in that transaction. A transaction failure leaves the previous certificate/key set intact. This is certificate storage, not activation on a web server.
The configuration check verifies token identity. It cannot prove write permission in advance; grant key:write on every certificate key under the configured prefix/domain path. Deployment verifies all four entries in the atomic transaction response.
4. Verification
Automated protocol tests cover request construction, failure handling and credential redaction. This integration has not been tested against a live account or device in this change. A successful configuration check verifies connectivity and read access; the first deployment also verifies write permissions.