Agent CA rotation: per-handshake certificate reload, in-band renewal, bundle-ready trust store - #5

Open

thdurante wants to merge 15 commits into

mainfrom

agent-ca-rotation

Commits on Sep 14, 2026

feat(protocol): add renew request/response commands

thdurante
and
claude
committed
1dfe88a
feat(tls): reload client certificate per handshake

thdurante
and
claude
committed
e392b07
feat(caroot): expose the embedded CA bundle as parsed certificates

thdurante
and
claude
committed
6e9c37d
chore: remove unused root-level ca.crt

thdurante
and
claude
committed
c21f940
test(testca): add DeployHQ-shaped certificate fixtures

thdurante
and
claude
committed
05a965c
feat(config): allow overriding the CA bundle with DEPLOY_AGENT_CA_FILE

thdurante
and
claude
committed
2e48afc
test(config): cover bundle verification and per-handshake certificate reload

thdurante
and
claude
committed
ace3bfa
feat(certrenew): validate and atomically install a renewed certificate

thdurante
and
claude
committed
e1dce4b
feat(tunnel): in-band certificate renewal

thdurante
and
claude
committed
0974f2e
docs: document certificate renewal and DEPLOY_AGENT_CA_FILE

thdurante
and
claude
committed
f25da13
feat(certrenew): treat an already-installed certificate as a no-op

thdurante
and
claude
committed
c4fb6a1

Commits on Sep 15, 2026

feat(caroot): trust the new DeployHQ Agent CA alongside the current one

thdurante
and
claude
committed
9319c3e

Commits on Sep 17, 2026

fix(certrenew): require client authentication when validating a renewal

thdurante
and
claude
committed
e9ce952
fix(config): reject a CA bundle whose certificates do not all parse

thdurante
and
claude
committed
73da9a4
fix(config): refuse a CA bundle with anything pem.Decode would skip

thdurante
and
claude
committed
b695b3a