issue 129: nothing makes a machine trust the mesh's own certificate authority #141

2026-09-26T21:59:42Z

jschoubben commented

2026-09-26 21:59:42 +00:00

On an enrolled workstation every internal HTTPS name fails verification ("unable to get local issuer certificate"): step-ca issues only to proxies, and no fact or module puts its root into a machine's trust store. ADR 0082's "the overlay is the transport security" answer covered the registry but cannot cover browsers, git over HTTPS or any verifying TLS client. Blocks retiring the predecessor's authority anywhere.

Report only — the fix needs a design decision first: installing a trust anchor is the most powerful thing a declaration could ask of a machine (a compromised controller could make every machine trust any authority), so the shape — a host primitive, name-constrained roots, or out-of-band installation — is the operator's call.

On an enrolled workstation every internal HTTPS name fails verification ("unable to get local issuer certificate"): step-ca issues only to proxies, and no fact or module puts its root into a machine's trust store. ADR 0082's "the overlay is the transport security" answer covered the registry but cannot cover browsers, git over HTTPS or any verifying TLS client. Blocks retiring the predecessor's authority anywhere. Report only — the fix needs a design decision first: installing a trust anchor is the most powerful thing a declaration could ask of a machine (a compromised controller could make every machine trust any authority), so the shape — a host primitive, name-constrained roots, or out-of-band installation — is the operator's call.

jschoubben added 1 commit 2026-09-26 21:59:43 +00:00

issue 129: nothing makes a machine trust the mesh's own certificate authority 60a53f9b18

jschoubben added 1 commit 2026-09-26 22:03:38 +00:00

129 review: the example name is a routed name, not a doubled suffix 90b8eeff6b

jschoubben merged commit a363a605cb into main

2026-09-26 22:57:31 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#141