This repo demonstrates a simple approach for provisioning servers with certificates signed by a custom certificate authority.

In order to test it, you need to define a linode_token variable inside secrets.tfvars, and then run:

$ ./ca-new consul-agent
$ terraform apply -var-file secrets.tfvars

This will provision a server with /etc/ssl/consul-agent/server1.dc1.consul.{crt,key}, which represents a certificate and key that have been signed by the local consul-agent CA.