Certificates need to be trusted by OMG applications

[macaptain]

The self-signed certificates won't be trusted by OMG applications running in the peered OMG clusters. You'll get something like:

SSL certificate problem: unable to get local issuer certificate

We could issue certificates to Vault via letsencrypt. The ACME challenge for renewals can be satisfied if the Vault cluster is permitted to write to DNS, rather than exposing any of the web services to the internet.

Or is there another way?

[macaptain]

Another option would be to use cfssl to create a trusted CA.