diff --git a/agent/connect_ca_endpoint.go b/agent/connect_ca_endpoint.go
index 49851baac0..dd8d4a4b74 100644
--- a/agent/connect_ca_endpoint.go
+++ b/agent/connect_ca_endpoint.go
@@ -76,14 +76,17 @@ func (s *HTTPServer) ConnectCAConfigurationSet(resp http.ResponseWriter, req *ht
 
 // A hack to fix up the config types inside of the map[string]interface{}
 // so that they get formatted correctly during json.Marshal. Without this,
-// duration values given as text like "24h" end up getting output back
+// string values that get converted to []uint8 end up getting output back
 // to the user in base64-encoded form.
 func fixupConfig(conf *structs.CAConfiguration) {
 	if conf.Provider == structs.ConsulCAProvider {
-		if v, ok := conf.Config["RotationPeriod"]; ok {
+		for k, v := range conf.Config {
 			if raw, ok := v.([]uint8); ok {
-				conf.Config["RotationPeriod"] = ca.Uint8ToString(raw)
+				conf.Config[k] = ca.Uint8ToString(raw)
 			}
 		}
+		if conf.Config["PrivateKey"] != "" {
+			conf.Config["PrivateKey"] = "hidden"
+		}
 	}
 }