# CA state + all issued key material / certs — NEVER commit. Regenerate via
# step-ca/bootstrap.sh. The bench CA is throwaway; production PKI is separate.
pki/
.env
# per-host enrolment scratch
enrol/out/
*.key
*.csr
*.der
*.pem