Rotating Cert's Still Not Clear

[jsaenz1000]

Nebula Version: 1.9.6

I've been following the docs mentioned in #1292 but I get the following error when updating existing hosts trust bundles from step 2 of the docs:

ERRO[0000] Failed to load ca from config   error="unable to read pki.ca file /opt/nebula/ca_test.crt: open /opt/nebula/ca_test.crt: no such file or directory"

Config Portion on remote host With New CA Appended:

pki:
  ca: /opt/nebula/ca.crt
  ca: /opt/nebula/ca_test.crt

If I copy over the new ca_test.crt and then restart Nebula it doesn't fail but then hosts still on the original cert can't connect. Nebula logs show it trusting only the fingerprint from the newly appended CA with no reference to the original/still valid CA. In the documentation, the order isn't clear to me on how the rotation process should go. i.e. - Create new CA, update YOUR machine first, then copy new ca.crt to hosts and update their configs with appended CA, etc, etc. I've tried multiple ways to rotate in a new cert but can't keep Nebula working while a config is referencing two different yet valid certs (one about to expire and the newly minted one). Thank you in advance.

[jsaenz1000]

While continuing to troubleshoot, I can get the rotation working when NOT referencing the CA as a file with-in the config and instead pasting the output from both of the CA files inline like in documentation example. However, it's stated that you can also append the CA as a file which is where I'm having trouble. Running a test on the config: ./nebula -test -config config.yml doesn't pass when the ca files are listed like below:

pki: 
  ca: /opt/nebula/ca.crt
      /opt/nebula/ca_test.crt

Nebula complains:

ERRO[0000] Failed to load ca from config     error="unable to read pki.ca file /opt/nebula/ca_1721876910.crt /opt/nebula/ca_1762100226.crt: open /opt/nebula/ca.crt /opt/nebula/ca_test.crt: no such file or directory"

Which is why my original post in this thread shows my config as such:

pki: 
  ca: /opt/nebula/ca.crt
  ca: /opt/nebula/ca_test.crt

Although testing the config passes, Nebula seems to only recognize the last ca: entry, negating the original and still trusted CA:

# this is the fingerprint for ca_test.crt and the only line about trusting a CA
DEBU[0000] Trusted CA fingerprints     fingerprints="[df630e0aea6e0034774fd5078eb568b7f0f403f902996deb1316ac111a51bcf5]"

So for me the issue is referencing more than one CA file with-in the ca: key without pasting the output inline.