Secure Agent Communication (TLS + Gossip)

This lab secures the control plane of a live Consul datacenter end to end. You start with a healthy three-server cluster (consul-server-1, consul-server-2, consul-server-3) that already encrypts its gossip traffic but runs its internal RPC in plaintext, and you harden it exactly as an operator would.

You will:

• Create a certificate authority with `consul tls ca create` and mint one

server certificate per node with `consul tls cert create -server`

• Configure the current nested `tls` stanza on all three agents with

`verify_incoming`, `verify_outgoing`, and `verify_server_hostname`, then restart the cluster so its RPC runs over mutual TLS

• Enable `auto_encrypt` so the servers hand out client certificates from the

built-in Connect CA instead of you distributing them by hand

• Rotate the gossip encryption key on the live cluster with the four-step

`consul keyring` workflow (install, use, remove) and no downtime

This is the hands-on counterpart to Section 05 of the Consul 101 course, and it uses the same nested `tls` configuration and `consul keyring` rotation procedure taught in those lessons.