# ca/ — PFV fleet Certificate Authority tooling [#697]

> Design + runbook (canonical): https://community.turnsys.com/t/320
> Root of trust for: LDAPS, RADIUS (#476), OPNsense, k8s, iDRAC/OME,
> Wazuh/syslog TLS. HSM-backed root ceremony comes later (#697 Nitrokey).

## Architecture (v1, software)

- **Root CA**: RSA-4096, 10y, OFFLINE — lives only in `/root/ca-root/` on
  tsys-ca (moved to Nitrokey at the #697 ceremony). Never leaves the box;
  signs only the intermediate.
- **Intermediate CA**: RSA-4096, 5y, on tsys-ca at `/etc/ssl/tsys-ca/` —
  signs all leaf certs. pathlen:0.
- **Leaves**: RSA-2048, ≤825 days, SAN-based (serverAuth + clientAuth).
- **No CRL/OCSP in v1** (fleet-internal); revocation = re-issue + intermediate
  pinning. CRL endpoint deferred to the GLPI/ITSM pass.
- **Compat stance**: RSA+SHA-256 only — old Dell/iDRAC-era clients.

## Files

| File | Purpose |
|------|---------|
| `ca-init.sh` | Initialize root + intermediate dirs ON THE CA HOST (keys never leave tsys-ca) |
| `issue-cert.sh` | Issue a leaf cert: `issue-cert.sh <common-name> "DNS:a,DNS:b,IP:x"` |
| `selftest.sh` | Full throwaway loop in /tmp — init, issue, chain-verify (TDD gate) |

## Usage (on tsys-ca, as root)

```bash
bash ca-init.sh /root/ca-root /etc/ssl/tsys-ca        # once
bash issue-cert.sh tsys-wazuh.knel.net "DNS:tsys-wazuh.knel.net,DNS:tsys-siem.knel.net"
```

Certs/CSRs land in the intermediate dir's `certs/` + `csr/`. Private keys
stay on tsys-ca (0600); nothing in this directory is ever committed with
key material.