The swarm's own service names cannot be signed by any hive CA: each
hive CA is name-constrained to its hive's domain, and the service
names are siblings of that domain, not children. Adding them to a
leaf's SAN list only trades a name-mismatch error for a
constraint-violation one.
So the root issues one more intermediate, constrained to exactly the
configured service names -- not to the whole swarm domain. A leaked
services CA mints forge./chat./auth. and nothing else.
Rotation is why this is separate rather than a second leaf off the
root: the constraint enumerates the names, so adding a service
re-issues this CA and never touches the root or any hive CA. The
name set is written beside the cert and compared on each start, which
is what makes re-issuance happen exactly when the names change --
not every boot, and not never. The list is sorted and deduplicated
for the same reason: an unstable order would churn a CA that things
are meant to pin.
Validity is deliberately much shorter than the root's. This CA is
meant to be re-issued, so a long window buys nothing and a short one
keeps the rotation path exercised rather than theoretical.
Carries the root's half-provisioned guard: a key beside a cert that
did not sign it looks like it works and issues nothing anyone trusts.
240ae79ad6