Repository navigation
fix(auth): tell a first-run operator where the first certificate comes from - #106
Merged
Merged
Conversation
…s from On a fleet nobody has logged in to yet, the no-certificate denial told the reader their fleet operator issues the certificate. At first run the reader is the operator and no certificate exists yet, so the landing page was a dead end. The install help now carries a short first-run section: issue the first admin credential from the operator CA the manager trusts (operatorCAPath), and a link to the deployment guide section with the OpenSSL recipe. Refs #70
Bugs5382
added a commit
that referenced
this pull request
Sep 25, 2026
…s from (#106) On a fleet nobody has logged in to yet, the no-certificate denial told the reader their fleet operator issues the certificate. At first run the reader is the operator and no certificate exists yet, so the landing page was a dead end. The install help now carries a short first-run section: issue the first admin credential from the operator CA the manager trusts (operatorCAPath), and a link to the deployment guide section with the OpenSSL recipe. Refs #70
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The web-side part of #70 that stands on its own today.
At first run nobody holds an operator certificate, so pressing Log in lands on the
no-certificate denial, whose help says "your fleet operator issues the certificate".
On a new fleet the reader is that operator and nothing has been issued, so the page
was a dead end.
The certificate install help now ends with a short "Standing up a new fleet?"
section: issue the first admin credential from the operator CA the manager trusts
(
operatorCAPath), install it as above, with a link to the manager deployment guidesection that carries the OpenSSL recipe and the level extension bytes.
This does not close #70. The conditional gate -- a first-run screen that skips
the operator-certificate requirement when the fleet is not bootstrapped -- needs the
manager to report bootstrap state and mint the first credential. That contract
(
GetBootstrapState/BootstrapOperatoronFleetService) is specified inCryptOS-PKI/cryptos-manager#78 and does not exist in
apiyet; the web first-run screen isstep 4 of that issue. When it lands, this section is superseded.
Refs #70
Verification
How this was verified
CertificateHelptest failed before the change and passes after: first-runheading,
operatorCAPathmention, and a link todeploying-standalone.md#3-...in the manager repo.
prettier --check .,eslint .,tsc --noEmit,vitest run(288 tests) andnpm run buildall clean locally.3-the-operator-ca-does-not-have-to-be-a-cryptos-nodeconfirmed presentin the rendered manager doc.