Comment 3 for bug 1835056

This looks like it has the same root cause as https://bugs.launchpad.net/charm-etcd/+bug/1832883. The easyrsa charm only publishes client certs once. In your case, juju most likely had not established all of the relations when easyrsa decided to publish its certs. The relations that were established after that moment were never provided the client certs.

Here is a workaround. After the deployment has settled, you can force easyrsa to re-publish the client cert to all of its relations:

juju run --unit easyrsa/0 -- charms.reactive clear_flag easyrsa.global-client-cert.created

Can you try that and see if it helps?