jschoubben 28b8feebfc The authority makes its own root at first start, and the proxy fetches it through a gate ...

step-ca's root certificate, its key and that key's password were own secrets — random
bytes the mesh minted, which no certificate is (novox/hq 04-ISSUES/076). The mesh
mints only the CA password now; step-ca makes its root at first start and serves it
at /roots.pem, which the manifest now names beside the ACME directory. The route
proxy fetches that root over the mesh network in a run-once step before it starts,
instead of being handed a served fact that could only be written before anything ran
(ADR 0098).

2026-09-21 22:26:28 +02:00

..

module.json

The authority makes its own root at first start, and the proxy fetches it through a gate

2026-09-21 22:26:28 +02:00