- install the vault rootca on all nodes - update ca-trust store on changes to the rootca certificate deployed