novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

The control plane pins the bus's certificate, and keeps its password out of errors #104

Merged
jschoubben merged 1 commits from fix/the-controller-pins-the-bus-certificate into main 2026-09-27 23:35:56 +00:00
Conversation 0 Commits 1 Files Changed 2
+49 -6
jschoubben commented 2026-09-27 23:35:46 +00:00
Owner
Copy Link
Copy Source

The bus presents the mesh's own certificate, which names nothing a public verifier accepts; the controller's NATS client verified by name and failed against a bus that was answering — "certificate is not valid for any names, but wanted to match …" (2026-09-28). It now pins the leaf's fingerprint from MESH_BROKER_CERTIFICATE, exactly as every host does (design 25 §4).

And a connection error named the whole URL, password included; the address alone now. That error was printed once tonight, so the controller's credential is rotated with rollout mint --again as the last step of the move.

The bus presents the mesh's own certificate, which names nothing a public verifier accepts; the controller's NATS client verified by name and failed against a bus that was answering — "certificate is not valid for any names, but wanted to match …" (2026-09-28). It now pins the leaf's fingerprint from `MESH_BROKER_CERTIFICATE`, exactly as every host does (design 25 §4). And a connection error named the whole URL, password included; the address alone now. That error was printed once tonight, so the controller's credential is rotated with `rollout mint --again` as the last step of the move.
jschoubben added 1 commit 2026-09-27 23:35:46 +00:00
The control plane pins the bus's certificate, and keeps its password out of errors 1fd6194ff8 
The bus presents the mesh's own certificate, which names nothing a public verifier
accepts; the client verified by name and failed against a bus that was answering
("certificate is not valid for any names", 2026-09-28). It now pins the leaf's
fingerprint from MESH_BROKER_CERTIFICATE, as every host does. And a connection
error named the whole URL, password included — the address alone now.
jschoubben merged commit 77643aa3f4 into main 2026-09-27 23:35:56 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#104