Comment 13 for bug 1417875

A manual work around:

After running ensure-availability one of the state machines will have a set of certificates that works for connecting.

Using the juju ssh command and the openssl command we can determine which state machine has the "good" certificates:

    juju ssh 0
    openssl s_client -connect 01-current-maas-node:6514 -CAfile /var/log/juju/ca-cert.pem

Continue with the other state servers until you find the one that returns the OK response for the openssl command. Copy the rsyslog-*.pem certs from that state server to the /var/log/juju folder of the other state servers and restart their respective rsyslog services.