From d2541647f22a3138caef9795f1795bfce63b2f24 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Sat, 5 Sep 2026 10:16:30 -0500 Subject: [PATCH] [#800] ACME e2e proof: IP-identifier issuance validated on sectestbed 5104 http-01 validation, issuance, and chain all verified against the fleet root via the prod endpoint; 5104 shut back down after the test. https://projects.knownelement.com/issues/800 --- docs/runbook-acme-prod.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/runbook-acme-prod.md b/docs/runbook-acme-prod.md index a24b4b9..cb56b5d 100644 --- a/docs/runbook-acme-prod.md +++ b/docs/runbook-acme-prod.md @@ -42,3 +42,20 @@ Consequences / rules for ACME http-01 across the fleet: E2E proof plan: boot sectestbed VM (5104), run lego there with an IP identifier (fresh VM, port 80 free), issue via the prod endpoint. + +## E2E PROOF (2026-09-05) — http-01 issuance VERIFIED + +sectestbed VM 5104 (dev PBS, tailnet 100.127.238.29, port 80 free): + + lego --server https://100.102.96.24:8443/acme/acme/directory \ + --email agent@knel.net --accept-tos \ + --domains 100.127.238.29 --http run + → Served key authentication → The server validated our request + → Server responded with a certificate + Issuer: CN=KNEL Fleet ACME Intermediate (ECDSA, under fleet RSA root) + SAN: IP:100.127.238.29 + +IP identifiers work. DNS identifiers work when the name resolves from +tsys-ca (rooted FQDN — add /etc/hosts entry on tsys-ca for test names). +Verify chain: openssl verify -CAfile root.crt -untrusted issuer.crt leaf.crt +VM shut back down after the test (lane rule).