Based on the log entry “failed to sign CSR: no certificate chain in the CSR response”, the CSR response does not contain a certificate chain. The failure may be caused by the following reasons:
- The CSR may not reach the Vault server, e.g., the Vault endpoint is not properly configured.
- The CSR reached the Vault server but the Vault server did not return a valid CSR response.
I suggest you add/turn on the logs on the client and Vault server to check what is the request sent from the client, whether the Vault server receives the request, and what is the response from the Vault server. Meanwhile, you can also use the Vault command line tool to directly sign a CSR at your Vault server and check whether the response contains a certificate chain.