From b8f88091f1f64bcfa2df9da30fee8dd708e06d48 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Thu, 2 Jul 2026 08:41:03 +0000 Subject: [PATCH] bootstrap: connect to step-ca via localhost, not ca.fleet.lab MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `step` CLI ran against --ca-url https://ca.fleet.lab:8443, but that name is only served by the fleet dnsmasq to booting clients — the serving host's own resolver can't resolve it ("no such host on 127.0.0.53"), so provisioner list + RADIUS cert issuance failed. Connect over CA_CONNECT (default localhost, which the compose puts in the CA cert SAN); CA_DNS stays the cert/SAN + RADIUS CN name. --- serving/dot1x-bench/step-ca/bootstrap.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/serving/dot1x-bench/step-ca/bootstrap.sh b/serving/dot1x-bench/step-ca/bootstrap.sh index 0123036..0fc1a6f 100755 --- a/serving/dot1x-bench/step-ca/bootstrap.sh +++ b/serving/dot1x-bench/step-ca/bootstrap.sh @@ -17,7 +17,14 @@ cd "$(dirname "$0")/.." [ -f .env ] && . ./.env CA_DNS=${CA_DNS:-ca.fleet.lab} CA_PORT=${CA_PORT:-8443} -CA_URL="https://${CA_DNS}:${CA_PORT}" +# The CLI must reach the CA over a name that RESOLVES on the serving host AND is +# in the CA cert's SAN. ca.fleet.lab is only served by the fleet dnsmasq to +# booting clients — the serving host itself can't resolve it — so default to +# 'localhost' (the compose adds it to DOCKER_STEPCA_INIT_DNS_NAMES). CA_DNS stays +# the cert/SAN name (and the RADIUS cert CN). Override CA_CONNECT if the CA is +# remote/reachable by another resolvable SAN. +CA_CONNECT=${CA_CONNECT:-localhost} +CA_URL="https://${CA_CONNECT}:${CA_PORT}" PKI=pki # step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created