14604a3176
Pebble skipped real HTTP-01 validation, which hid integration gaps for compliance-page custom domains. step-ca with a Caddy port-80 proxy exercises the same path production uses while keeping issued certs persistent across compose restarts. Signed-off-by: Bryan Frimin <bryan@probo.com>
1.0 KiB
step-ca local CA
This directory holds the persistent step-ca
state for local custom-domain TLS. It is initialized on first make stack-up.
After the first run, install the root CA once so browsers and server-side TLS clients (e.g. CIMD OAuth) trust issued certificates across restarts:
step certificate install compose/step-ca/certs/root_ca.crt
The ACME directory URL is https://localhost:9000/acme/acme/directory.
step-ca shares the acme-http-01-proxy container network so HTTP-01 validation
to http://<hostname>/.well-known/acme-challenge/... reaches Caddy on port 80,
which forwards to probod's trust-center HTTP listener on the host.
Custom domain DNS (optional)
Managed compliance-page domains (*.probopage.localhost) resolve via the
.localhost TLD and skip DNS checks.
For customer custom domains in local dev, point DNS at the host via
/etc/hosts and ensure HTTP-01 reaches probod through the
acme-http-01-proxy service on port 80.