Audiobuzz
b8f88091f1
The `step` CLI ran against --ca-url https://ca.fleet.lab:8443, but that name is only served by the fleet dnsmasq to booting clients — the serving host's own resolver can't resolve it ("no such host on 127.0.0.53"), so provisioner list + RADIUS cert issuance failed. Connect over CA_CONNECT (default localhost, which the compose puts in the CA cert SAN); CA_DNS stays the cert/SAN + RADIUS CN name.