`CA is uninitialized and unable to sign certificates yet: no root certificate` on Vault CA

#### Overview of the Issue

I'm trying to configure Connect CA with Vault CA.

I have three level CA by historical causes:
1. Root CA - in external Vault CA standalone instance
2. `pki_server` - Server CA. Signed with Root CA
3. `pki_consul` - Consul CA. Currently empty

`consul.hcl`:
```
connect {
enabled = true
ca_provider = "vault"
ca_config {
address = "https://127.0.0.1:8200"
token = "..."
ca_file = "/etc/consul.d/tls/root_ca.crt"
cert_file = "/etc/consul.d/tls/consul_intermediate.crt"
key_file = "/etc/consul.d/tls/consul.key"
root_pki_path = "pki_server"
intermediate_pki_path = "pki_consul"
}
}
```
`consul.key` and `consul_intermediate.crt` issued by `pki_server` and works correctly

After Consul server starts it successfully connect to Vault and configure `pki_consul`:
1. Generate key
2. Create role `leaf-cert`
3. Create default issuer signed with `pki_server`

These certs correctly loaded into Consul `/connect/ca/roots`:
```
curl -s --header "X-Consul-Token: ${CONSUL_HTTP_TOKEN}" ${CONSUL_HTTP_ADDR}/v1/agent/connect/ca/roots | jq -r
{
"ActiveRootID": "e7:0c:b9:8e:7c:8c:3d:d5:37:d2:d6:32:81:bd:a9:2b:ad:9b:03:30",
"TrustDomain": "754ac5be-d6bc-63b6-7679-3fad69300af3.consul",
"Roots": [
{
"ID": "e7:0c:b9:8e:7c:8c:3d:d5:37:d2:d6:32:81:bd:a9:2b:ad:9b:03:30",
"Name": "Vault CA Primary Cert",
"SerialNumber": 124673157755710518,
"SigningKeyID": "03:25:f6:75:da:fe:13:6a:ae:19:25:0c:cb:0e:6c:75:a2:a4:c3:65",
"ExternalTrustDomain": "754ac5be-d6bc-63b6-7679-3fad69300af3",
"NotBefore": "2026-06-19T12:15:15Z",
"NotAfter": "2036-06-15T11:04:54Z",
"RootCert": "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n",
"IntermediateCerts": [
"-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n"
],
"Active": true,
"PrivateKeyType": "ec",
"PrivateKeyBits": 384,
"CreateIndex": 11,
"ModifyIndex": 262
}
]
}

```

But in logs I get error

```
Jul 10 11:29:36 consul[16353]: 2026-07-10T11:29:36.932+0300 [INFO] connect.ca.vault: Found existing Intermediate PKI path mount: namespace="" path=pki_consul
Jul 10 11:29:36 consul[16353]: connect.ca.vault: Found existing Intermediate PKI path mount: namespace="" path=pki_consul/
Jul 10 11:29:36 consul[16353]: 2026-07-10T11:29:36.947+0300 [INFO] connect.ca.vault: Successfully renewed token for Vault provider
Jul 10 11:29:36 consul[16353]: connect.ca.vault: Successfully renewed token for Vault provider
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.810+0300 [DEBUG] agent.server.cert-manager: server management token watch fired - resetting leaf cert watch
Jul 10 11:29:37 consul[16353]: agent.server.cert-manager: server management token watch fired - resetting leaf cert watch
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.811+0300 [DEBUG] agent.server.cert-manager: CA config watch fired - updating auto TLS server name: name=server.dc1.peering.754ac5be-d6bc-63b6-7679-3fad69300af3.consul
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.811+0300 [ERROR] agent.leaf-certs: leaf certificate renewal failed: service="" kind= error="CA is uninitialized and unable to sign certificates yet: no root certificate" total_failures=1 suggested_action="Check CA availability, network connectivity, and ACL permissions. Certificate may expire if renewal continues to fail."
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.811+0300 [WARN] agent.leaf-certs: handling error in Manager.Notify: error="CA is uninitialized and unable to sign certificates yet: no root certificate" index=1
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.812+0300 [ERROR] agent.leaf-certs: leaf certificate renewal failed: service="" kind= error="CA is uninitialized and unable to sign certificates yet: no root certificate" total_failures=2 suggested_action="Check CA availability, network connectivity, and ACL permissions. Certificate may expire if renewal continues to fail."
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.812+0300 [WARN] agent.leaf-certs: handling error in Manager.Notify: error="CA is uninitialized and unable to sign certificates yet: no root certificate" index=1
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.812+0300 [ERROR] agent.leaf-certs: leaf certificate renewal failed: service="" kind= error="CA is uninitialized and unable to sign certificates yet: no root certificate" total_failures=3 suggested_action="Check CA availability, network connectivity, and ACL permissions. Certificate may expire if renewal continues to fail."
Jul 10 11:29:37 consul[16353]: 2026-07-10T11:29:37.812+0300 [WARN] agent.leaf-certs: handling error in Manager.Notify: error="CA is uninitialized and unable to sign certificates yet: no root certificate" index=1
Jul 10 11:29:37 consul[16353]: agent.server.cert-manager: CA config watch fired - updating auto TLS server name: name=server.dc1.peering.754ac5be-d6bc-63b6-7679-3fad69300af3.consul
Jul 10 11:29:37 consul[16353]: agent.leaf-certs: leaf certificate renewal failed: service="" kind= error="CA is uninitialized and unable to sign certificates yet: no root certificate" total_failures=1 suggested_action="Check CA availability, network connectivity, and ACL permissions. Certificate may expire if renewal continues to fail."
Jul 10 11:29:37 consul[16353]: agent.leaf-certs: handling error in Manager.Notify: error="CA is uninitialized and unable to sign certificates yet: no root certificate" index=1

```

Did I miss something?

### Consul info for Server

Server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 16a4c49f
version = 2.0.1
version_metadata =
consul:
acl = enabled
bootstrap = false
known_datacenters = 1
leader = true
leader_addr = 127.0.0.1:8300
server = true
raft:
applied_index = 364
commit_index = 364
fsm_pending = 0
last_contact = 0
last_log_index = 364
last_log_term = 11
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = [{...}]
latest_configuration_index = 0
num_peers = 0
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Leader
term = 11
runtime:
arch = amd64
cpu_count = 1
goroutines = 168
max_procs = 1
os = linux
version = go1.26.4
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 1
event_time = 11
failed = 0
health_score = 0
intent_queue = 1
left = 0
member_time = 11
members = 1
query_queue = 0
query_time = 1
```

```
Server agent HCL config
```

Reproduce the configuration from consul.hcl with the Vault CA provider, then inspect the provider initialization and agent.leaf-certs renewal path around the reported no-root error. Compare the configured CA with the /v1/agent/connect/ca/roots response and verify that leaf certificate renewal succeeds without the uninitialized-CA error.

Written by the indexing model from the issue text.