When architecting a Vault replication configuration, why should you never terminate TLS on a front-end...

If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.

Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.

Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.

Vault replication won't work with the type of certificates that a traditional load balancer uses.