You must join Cryptographic Security Platform Vault nodes to a cluster while the nodes are using the default self-signed certificate on port 8443. If you install a custom certificate on a node before joining the node to a cluster, the join operation does not work as expected.

To deploy a cluster with custom certificates

1. Deploy all nodes. For information about deploying a node, see the page for your deployment environment:
   • Installing CSP Vault from an OVA template
   • Installing the First CSP Vault Node from an ISO Image
   • Installing the First CSP Vault Node on a Bare Metal Server from an ISO
   • Deploying the first CSP Vault node in AWS
   • Deploying the First CSP Vault Node in GCP
   • Deploying a CSP Vault Node in Azure
2. Join all the nodes to the cluster while each is still using the default self-signed certificate. For information about joining a node, see: Joining a CSP Vault Cluster.
3. After the cluster is formed, install the custom certificate on each node. For information about installing custom certificate on nodes, see: Installing External Certificates for Internal and External Webservers.

To add a node to a cluster with custom certificates

Use this procedure to add a node to an existing cluster that uses custom certificates. 

1. Revert the cluster nodes to the default self-signed certificate. For information about using self-signed certificates for cluster nodes, see: Using Self-Signed Certificates for All Nodes in a Cluster.
2. Join the new node. For information about joining a node, see: Joining a CSP Vault Cluster.
3. Reinstall the custom certificates on all nodes. For information about installing custom certificate on nodes, see: Installing External Certificates for Internal and External Webservers