sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

TODO #11: step signer re-verified on the serving host (720h claim, chain)

Browse Source
This commit is contained in:
Audiobuzz
2026-07-02 08:45:30 +00:00
parent b8f88091f1
commit a370f80332
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+9
View File
@@ -1018,6 +1018,15 @@ reachable step-ca, populate `serving/enrol-pki/`, and `ENROL_ADMIN_INSECURE=fals
**STEP SIGNER VERIFIED end-to-end 2026-06-28** (broker → real step-ca → signed **STEP SIGNER VERIFIED end-to-end 2026-06-28** (broker → real step-ca → signed
cert that chains to the fleet root; hostnqn derived from serial; EKU clientAuth). cert that chains to the fleet root; hostnqn derived from serial; EKU clientAuth).
**Re-VERIFIED ON THE SERVING HOST 2026-07-02** against step-ca 0.30.2 via
`verify-serving.sh` through the nginx `/enrol/` proxy: issuer = Fleet Bench CA
Intermediate, cert validity exactly 720h (confirms the maxTLSCertDuration claim
raise took effect), EKU clientAuth, `enrol` provisioner extension present,
hostnqn = cert serial. Bring-up gotchas hit + fixed (all in the commits): the CA
wouldn't init (compose used `_PASSWORD_FILE` for a nonexistent file → use
`_PASSWORD`); Docker auto-created `./pki` root-owned (bootstrap self-heals perms +
pre-create the bind-mount dirs); the CLI couldn't resolve `ca.fleet.lab` on the
serving host (connect via `localhost`, which is in the CA SAN).
Verification found + fixed two things the `mock` path had hidden: Verification found + fixed two things the `mock` path had hidden:
- **BUG FIXED (`signer.go`):** `--not-after` was passed to `step ca token` - **BUG FIXED (`signer.go`):** `--not-after` was passed to `step ca token`
(validity capped ~1h → "token validity too long") instead of `step ca sign`. (validity capped ~1h → "token validity too long") instead of `step ca sign`.