sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

bootstrap: connect to step-ca via localhost, not ca.fleet.lab

Browse Source 
The `step` CLI ran against --ca-url https://ca.fleet.lab:8443, but that name is
only served by the fleet dnsmasq to booting clients — the serving host's own
resolver can't resolve it ("no such host on 127.0.0.53"), so provisioner list +
RADIUS cert issuance failed. Connect over CA_CONNECT (default localhost, which
the compose puts in the CA cert SAN); CA_DNS stays the cert/SAN + RADIUS CN name.
This commit is contained in:
Audiobuzz
2026-07-02 08:41:03 +00:00
parent 8376f9a92e
commit b8f88091f1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/dot1x-bench/step-ca/bootstrap.sh
+8 -1
View File
@@ -17,7 +17,14 @@ cd "$(dirname "$0")/.."
[ -f .env ] && . ./.env [ -f .env ] && . ./.env
CA_DNS=${CA_DNS:-ca.fleet.lab} CA_DNS=${CA_DNS:-ca.fleet.lab}
CA_PORT=${CA_PORT:-8443} CA_PORT=${CA_PORT:-8443}
CA_URL="https://${CA_DNS}:${CA_PORT}" # The CLI must reach the CA over a name that RESOLVES on the serving host AND is
# in the CA cert's SAN. ca.fleet.lab is only served by the fleet dnsmasq to
# booting clients — the serving host itself can't resolve it — so default to
# 'localhost' (the compose adds it to DOCKER_STEPCA_INIT_DNS_NAMES). CA_DNS stays
# the cert/SAN name (and the RADIUS cert CN). Override CA_CONNECT if the CA is
# remote/reachable by another resolvable SAN.
CA_CONNECT=${CA_CONNECT:-localhost}
CA_URL="https://${CA_CONNECT}:${CA_PORT}"
PKI=pki PKI=pki
# step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created # step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created