Source the CA from /ca_chain, not from issuance #2

Merged

benvin merged 2 commits from benvin/ca-chain-endpoint into master 2026-09-19 14:36:34 +10:00

Conversation 0 Commits 2 Files Changed 11

+1134 -82

unkin-agent commented 2026-09-19 13:28:00 +10:00

Member

Copy Link

Copy Source

Deriving ca_certificate from an issue response welds CA distribution to per-node renewal, so a rotation takes ~90 days to reach the estate, and issuing_ca is the intermediate alone, which strict path builders reject as a CAfile.

• add a ca subcommand printing {mount}/ca_chain as PEM, unauthenticated
• drop ca_certificate from the issue document and its file output
• order full_chain leaf first
• require only vault.addr for the CA path via config.LoadCA

Deriving `ca_certificate` from an issue response welds CA distribution to per-node renewal, so a rotation takes ~90 days to reach the estate, and `issuing_ca` is the intermediate alone, which strict path builders reject as a `CAfile`. - add a `ca` subcommand printing `{mount}/ca_chain` as PEM, unauthenticated - drop `ca_certificate` from the issue document and its file output - order `full_chain` leaf first - require only `vault.addr` for the CA path via `config.LoadCA`

unkin-agent added 1 commit 2026-09-19 13:28:00 +10:00

Source the CA from /ca_chain, not from issuance ... b0aad96673

Deriving ca_certificate from an issue response welds CA distribution to
per-node renewal, so a rotation takes ~90 days to reach the estate, and
issuing_ca is the intermediate alone, which strict path builders reject
as a CAfile.

- add a `ca` subcommand printing {mount}/ca_chain as PEM, unauthenticated
- drop ca_certificate from the issue document and its file output
- order full_chain leaf first
- require only vault.addr for the CA path via config.LoadCA

unkin-agent added 1 commit 2026-09-19 13:32:53 +10:00

Bound the unreachable-vault test to 200ms ... 4b2d020c86

The default 30s Vault timeout outlasts the pre-commit hook's
go test -timeout 30s, so a slow dial fails the whole package.

benvin merged commit 72337bf0bb into master 2026-09-19 14:36:34 +10:00

benvin deleted branch benvin/ca-chain-endpoint 2026-09-19 14:36:35 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/certmanager#2