Files

T

mrcharles 1620351028 feat(ca): artifact mirror live — pinned wazuh-agent debs on tsys-ca [#758 ]

dist/wazuh-agent/4.14.7-1/ (amd64+arm64+armhf) + SHA256SUMS, autoindex
enabled, workstation hash-verified against published manifest.
deploy-agent.sh now installs from the mirror (upstream fallback) and
auto-detects arch. #335: kali-tsys enrolled+active (30 total agents).

Detail: https://projects.knownelement.com/issues/758

2026-09-03 13:25:28 -05:00

artifact-mirror.sh

feat(ca): artifact mirror live — pinned wazuh-agent debs on tsys-ca [#758 ]

2026-09-03 13:25:28 -05:00

ca-init.sh

feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697 ]

2026-09-03 07:52:07 -05:00

issue-cert.sh

feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697 ]

2026-09-03 07:52:07 -05:00

README.md

feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697 ]

2026-09-03 07:52:07 -05:00

selftest.sh

feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697 ]

2026-09-03 07:52:07 -05:00

README.md

ca/ — PFV fleet Certificate Authority tooling [#697]

Design + runbook (canonical): https://community.turnsys.com/t/320 Root of trust for: LDAPS, RADIUS (#476), OPNsense, k8s, iDRAC/OME, Wazuh/syslog TLS. HSM-backed root ceremony comes later (#697 Nitrokey).

Architecture (v1, software)

Root CA: RSA-4096, 10y, OFFLINE — lives only in /root/ca-root/ on tsys-ca (moved to Nitrokey at the #697 ceremony). Never leaves the box; signs only the intermediate.
Intermediate CA: RSA-4096, 5y, on tsys-ca at /etc/ssl/tsys-ca/ — signs all leaf certs. pathlen:0.
Leaves: RSA-2048, ≤825 days, SAN-based (serverAuth + clientAuth).
No CRL/OCSP in v1 (fleet-internal); revocation = re-issue + intermediate pinning. CRL endpoint deferred to the GLPI/ITSM pass.
Compat stance: RSA+SHA-256 only — old Dell/iDRAC-era clients.

Files

File	Purpose
`ca-init.sh`	Initialize root + intermediate dirs ON THE CA HOST (keys never leave tsys-ca)
`issue-cert.sh`	Issue a leaf cert: `issue-cert.sh <common-name> "DNS:a,DNS:b,IP:x"`
`selftest.sh`	Full throwaway loop in /tmp — init, issue, chain-verify (TDD gate)

Usage (on tsys-ca, as root)

bash ca-init.sh /root/ca-root /etc/ssl/tsys-ca        # once
bash issue-cert.sh tsys-wazuh.knel.net "DNS:tsys-wazuh.knel.net,DNS:tsys-siem.knel.net"

Certs/CSRs land in the intermediate dir's certs/ + csr/. Private keys stay on tsys-ca (0600); nothing in this directory is ever committed with key material.