vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: keep ca-key.pem on disk, and re-issue a leaf that does not match its key

Browse source 
hive-tls-ca no longer deletes a ca-key.pem an earlier generation left:
nothing reads it, and leaving it means a rollback finds the old key instead
of minting a new anchor. Deleting it moves to PR 3, beside dropping ca.pem
from the trust bundle.

hive-tls-resign now also re-issues when the leaf's public key differs from
the key file's. The leaf and key are moved into place by two renames, and an
interrupted pair left a certificate beside the wrong key that the validity
check accepted.

Refs #4588
This commit is contained in:
atlas 2026-10-04 15:49:31 +02:00 • committed by mara
commit fc33a62bf8
4 changed files with 39 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/host-modules/hive-tls.nix
View file

@ -241,8 +241,8 @@ in
# The gateway serves a short-lived **leaf** issued by the secret store's
# `pki` mount through this hive's own role, and consumers (agents,
# federation peers) anchor on that mount's root, which ships in
# `trust-bundle.pem`. Leaf rotation never re-breaks them, and no key that
# signs a certificate exists on this host. See
# `trust-bundle.pem`. Leaf rotation never re-breaks them, and nothing here
# generates or signs with a CA key. See
# `docs/networking/gateway.md` ("Self-signed TLS") and docs/swarm/ca.md.
#
# The trust bundle still carries the retired hive CA's public `ca.pem`
@ -259,7 +259,8 @@ in
leaf the store issues and nginx serves) and `trust-bundle.pem` (the
anchors agents and federation peers trust). `ca.pem` and
`ca-previous.pem`, where present, are the retired hive CA's public
certificates and stay in the bundle; no CA key is kept here.
certificates and stay in the bundle. A `ca-key.pem` an earlier
generation left is neither read nor removed.
'';
};
@ -396,13 +397,6 @@ in
root=${lib.escapeShellArg "${swarmCaCfg.stateDir}/root.pem"}
svcroot="$d/swarm-services-root.pem"
# The gateway leaf comes from the store, so no key that signs a
# certificate is kept here.
if [ -e "$d/ca-key.pem" ]; then
echo "removing the retired hive CA key $d/ca-key.pem"
rm -f "$d/ca-key.pem"
fi
# --- Trust bundle: what a consumer must TRUST. Why it is a set of
# anchors rather than one file is in docs/swarm/ca.md. Three
# constraints the code cannot state:
@ -444,7 +438,8 @@ in
# The gateway leaf: issued by the secret store's `pki` mount through
# this hive's own role, at boot, on every deploy and from the daily
# timer below, whenever it is missing, past half its lifetime, missing
# a configured name, or not chained to the store's root.
# a configured name, not chained to the store's root, or not matching
# its key.
#
# ⚠️ Nothing orders the gateway against this unit, which is what lets a
# hive holding a valid leaf start its gateway with the store sealed or
@ -530,9 +525,14 @@ in
# A leaf the retired hive CA signed, or one under a store root since
# replaced, fails this and is re-issued.
{ [ -s "$svcroot" ] && openssl verify -CAfile "$svcroot" "$leaf" >/dev/null 2>&1; } || reissue=1
# The leaf and the key are two renames, so an interrupted rotation can
# leave a certificate beside a key it does not belong to.
leafpub="$(openssl x509 -in "$leaf" -noout -pubkey 2>/dev/null || true)"
keypub="$(openssl pkey -in "$leafk" -pubout 2>/dev/null || true)"
{ [ -n "$leafpub" ] && [ "$leafpub" = "$keypub" ]; } || reissue=1
if [ "$reissue" = 0 ]; then
echo "gateway leaf valid, chained to the store's root and covering the configured names — leaving it alone"
echo "gateway leaf valid, matching its key, chained to the store's root and covering the configured names — leaving it alone"
exit 0
fi