mrcharles
82fdb161cc
ca-init/issue-cert/selftest (TDD loop, shellcheck clean); design doc on Discourse t/320. Offline RSA-4096 root (Nitrokey ceremony later), 5y intermediate, 825d SAN leaves. First cert: tsys-wazuh.knel.net (fingerprint on the ticket note). Meat: https://projects.knownelement.com/issues/697#note-4033
1.5 KiB
1.5 KiB
ca/ — PFV fleet Certificate Authority tooling [#697]
Design + runbook (canonical): https://community.turnsys.com/t/320 Root of trust for: LDAPS, RADIUS (#476), OPNsense, k8s, iDRAC/OME, Wazuh/syslog TLS. HSM-backed root ceremony comes later (#697 Nitrokey).
Architecture (v1, software)
- Root CA: RSA-4096, 10y, OFFLINE — lives only in
/root/ca-root/on tsys-ca (moved to Nitrokey at the #697 ceremony). Never leaves the box; signs only the intermediate. - Intermediate CA: RSA-4096, 5y, on tsys-ca at
/etc/ssl/tsys-ca/— signs all leaf certs. pathlen:0. - Leaves: RSA-2048, ≤825 days, SAN-based (serverAuth + clientAuth).
- No CRL/OCSP in v1 (fleet-internal); revocation = re-issue + intermediate pinning. CRL endpoint deferred to the GLPI/ITSM pass.
- Compat stance: RSA+SHA-256 only — old Dell/iDRAC-era clients.
Files
| File | Purpose |
|---|---|
ca-init.sh |
Initialize root + intermediate dirs ON THE CA HOST (keys never leave tsys-ca) |
issue-cert.sh |
Issue a leaf cert: issue-cert.sh <common-name> "DNS:a,DNS:b,IP:x" |
selftest.sh |
Full throwaway loop in /tmp — init, issue, chain-verify (TDD gate) |
Usage (on tsys-ca, as root)
bash ca-init.sh /root/ca-root /etc/ssl/tsys-ca # once
bash issue-cert.sh tsys-wazuh.knel.net "DNS:tsys-wazuh.knel.net,DNS:tsys-siem.knel.net"
Certs/CSRs land in the intermediate dir's certs/ + csr/. Private keys
stay on tsys-ca (0600); nothing in this directory is ever committed with
key material.