Comment 3 for bug 1835056

George Kraft (cynerva) wrote :

This looks like it has the same root cause as The easyrsa charm only publishes client certs once. In your case, juju most likely had not established all of the relations when easyrsa decided to publish its certs. The relations that were established after that moment were never provided the client certs.

Here is a workaround. After the deployment has settled, you can force easyrsa to re-publish the client cert to all of its relations:

juju run --unit easyrsa/0 -- charms.reactive clear_flag

Can you try that and see if it helps?