tls
Certificates, chains of trust, and issuing them without a public endpoint.
-
DNS Wildcards and Empty Non-Terminals: The Answer That Is Not an Error
A stale ACME DNS-01 TXT record can turn part of a domain into an empty non-terminal, and RFC 1034's wildcard rule then refuses to cover it — not as a bug, but as specified behaviour. This walks through the closest-encloser algorithm behind that refusal, reproduces it with a BIND container and a small zone file, and gives a script and a record-lifecycle pattern that catch the problem before it reaches production.
-
cert-manager for Mesh-Only Names That No ACME Challenge Can Reach
ACME's HTTP-01 and DNS-01 challenges both assume the certificate authority can reach or resolve something public, which is exactly what a mesh-only hostname does not have. This article shows why a cert-manager CA Issuer is the correct tool for that case, what it costs in trust distribution, and a complete kind-based example that issues and verifies a certificate for a private name.
-
Trusting an Internal and a Public Certificate Authority in One Process
Pointing a process at an internal certificate authority by overriding its trust store is the fastest way to make it work, and it silently cuts that same process off from every publicly signed endpoint it also needs to reach, such as an external identity provider. This article shows the difference between replacing a trust store and appending to it, with a Dockerfile and a Python client that get it right.
-
Replacing Distributed SSH Keys with a Vault Certificate Authority
Copying a public key into every host's authorized_keys file does not scale and leaves no record of who was granted access or when. This walks through standing up Vault's SSH secrets engine as a certificate authority, signing short-lived user certificates on demand, and shows a complete, runnable demonstration against a disposable sshd container.