novox/mesh-catalog
6
0
Fork 0
Code Issues Pull Requests 4 Packages Projects Releases Wiki Activity

step-ca: stop offering acme-ca, so public names are certified by public-acme #234

Merged
jschoubben merged 1 commits from fix/step-ca-is-not-the-public-acme-ca into main 2026-10-03 08:57:25 +00:00
Conversation 0 Commits 1 Files Changed 1
-8
jschoubben commented 2026-10-03 08:55:08 +00:00
Owner
Copy Link
Copy Source

Outage fix. Since 2026-10-03 ~08:30 every public name on novox served a certificate from Mesh Internal CA: route-proxy's acme-ca was bound to step-ca instead of public-acme.

Both modules offered acme-ca on novox, and route-proxy's pin (acme-ca from novox) names a node, not a module — so the choice depended on provider order, which changed when the controller restarted.

step-ca's own job (internal names) already runs through internal-acme-ca; route-proxy is the only acme-ca consumer. Removing the offer leaves public-acme as the sole provider. route-proxy's cache is per authority, so the previous Let's Encrypt certificates are found again without re-issuance.

Follow-up (controller): a pin should name (node, module), per to-be 23.

**Outage fix.** Since 2026-10-03 ~08:30 every public name on novox served a certificate from *Mesh Internal CA*: route-proxy's `acme-ca` was bound to step-ca instead of public-acme. Both modules offered `acme-ca` on novox, and route-proxy's pin (`acme-ca from novox`) names a node, not a module — so the choice depended on provider order, which changed when the controller restarted. step-ca's own job (internal names) already runs through `internal-acme-ca`; route-proxy is the only `acme-ca` consumer. Removing the offer leaves public-acme as the sole provider. route-proxy's cache is per authority, so the previous Let's Encrypt certificates are found again without re-issuance. Follow-up (controller): a pin should name (node, module), per to-be 23.
jschoubben added 1 commit 2026-10-03 08:55:08 +00:00
step-ca: stop offering acme-ca, so public names are certified by public-acme 0778f8f0ae 
step-ca and public-acme both offered acme-ca on novox, and route-proxy's pin names a node, not
a module — so which one certified the public names depended on provider order. After the
controller restart on 2026-10-03 it came out as step-ca, and every public site served a
certificate no browser trusts. step-ca's own names are already certified through
internal-acme-ca; acme-ca is the public authority's alone.
jschoubben merged commit 85af10ebad into main 2026-10-03 08:57:25 +00:00
jschoubben deleted branch fix/step-ca-is-not-the-public-acme-ca 2026-10-03 08:57:25 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#234