---
layout: docs
page_title: Bootstrap certificate authority on virtual machines (VM)
description: >-
  Consul uses a certificate authority (CA) to generate, use, manage, sign, and store certificates for your service mesh. Learn how to bootstrap the certificate authority on VMs.
---

# Bootstrap certificate authority on virtual machines (VM)

Consul service mesh comes with a built-in Certificate Authority (CA) that will
bootstrap by default when you first [enable](/consul/docs/reference/agent/configuration-file/service-mesh#connect_enabled) Consul service mesh on your servers.

To use the built-in CA, enable it in the server's configuration.

```hcl
connect {
  enabled = true
}
```

This configuration change requires a Consul server restart, which you can perform one server at a time
to maintain availability in an existing datacenter.

When a server is enabled with Consul Service mesh and becomes the leader, it will
bootstrap a new CA and generate it's own private key which is written to the
Raft state.

Alternatively, an external private key can be provided via the [CA
configuration](/consul/docs/secure-mesh/certificate/built-in#specifying-a-custom-private-key-and-root-certificate).

~> External CAs: Consul has been designed with a pluggable CA component so external CAs can be
integrated. For production workloads we recommend using [Vault or another external
CA](/consul/docs/secure-mesh/certificate/vault) once
available such that the root key is not stored within Consul state at all.
