[P3] Self-signed server cert has 10-year validity, no rotation path #8
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
[claude 2026-07-02] From architecture review (transport). transport.GenerateServerCert (internal/transport/tlsconf.go:38) sets NotAfter +10y with no rotation mechanism. Pinning blocks MITM, but a stolen server.key is usable for a decade. Reduce validity to 1-2y and add a rotation ceremony (regenerate + re-pin via new join blobs); document it.
Migrated from git-collab issue
d51e260f8b3b7f1abab8a851d50f38180ece8fb0.Original author: a73x dev@a73x.sh.
Close reason: Fixed by patch
5de01ffb[claude 2026-07-03] Picking this up. Plan: GenerateServerCert validity 10y -> 2y; new transport.CertRenewalDue(certPEM, now) helper (due when within 90d of NotAfter); eitri-server warns at startup when renewal is due; docs/cert-rotation.md runbook (rotation = regenerate cert + re-pin agents via new join blobs; pinning ignores expiry so an expired cert never breaks the running fleet — the warning drives operator cadence).