Load a persistent CA from disk #31

Merged

mikluko merged 1 commit from feat/persistent-ca into main

2026-10-26 21:00:58 +00:00

mikluko commented

2026-10-26 21:00:10 +00:00

Owner

Closes #6.

-ca-cert and -ca-key read the CA from PEM files, and create both when neither exists. The key is written with mode 0600 and a non-CA certificate is refused. -print-ca prints the CA in use. -ca-name and -ca-org set a generated CA's subject.

A command test checks the point of the issue: a client trusting only the persisted root completes an intercepted request with verification on.

Generated roots are now signed with SHA-256 instead of SHA-1 and carry a random serial. The command's roots are valid for 10 years.

Closes #6. `-ca-cert` and `-ca-key` read the CA from PEM files, and create both when neither exists. The key is written with mode 0600 and a non-CA certificate is refused. `-print-ca` prints the CA in use. `-ca-name` and `-ca-org` set a generated CA's subject. A command test checks the point of the issue: a client trusting only the persisted root completes an intercepted request with verification on. Generated roots are now signed with SHA-256 instead of SHA-1 and carry a random serial. The command's roots are valid for 10 years.

mikluko added 1 commit

2026-10-26 21:00:10 +00:00

Load a persistent CA from disk

CI / changelog (pull_request) Successful in 6s

Details

CI / test (pull_request) Successful in 34s

Details

958f5af163

-ca-cert and -ca-key read the CA, and create both files when neither exists,
so a client can trust the proxy instead of skipping verification. -print-ca
exports it; -ca-name and -ca-org name a generated one.

Closes #6

mikluko merged commit ab17e8a6dd into main

2026-10-26 21:00:58 +00:00

mikluko deleted branch feat/persistent-ca

2026-10-26 21:00:59 +00:00

mikluko referenced this pull request from a commit

2026-10-26 21:01:00 +00:00

Merge pull request 'Load a persistent CA from disk' (#31) from feat/persistent-ca into main