fix(console): netcheck - a vendor's customer cannot set custom_ca_certs

CuOS is also how vendors build images for their customers, and those
customers do not manage the system configuration. Option b for an unknown
CA now names both ways: ask the vendor to include the CA in the image, or
add it to custom_ca_certs where the configuration is your own.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

docs/common/cuos-api.md

@@ -151,11 +151,13 @@ failure behind it.
   connection. Three more probes narrow it down: without the post-quantum key
   share (a middlebox that cannot handle the larger ClientHello), without a
   server name and with a neutral one (a filter by server name).
-- **Certificate / CA.** A public CA is OK. A CA from `custom_ca_certs` is a
-  **warning** — TLS inspection is a supported mode, as update images are
-  verified by digest, not by trusting the connection. Any other CA is an error
-  with two ways out: exempt the registry from inspection, or add the inspection
-  CA to `custom_ca_certs`.
+- **Certificate / CA.** A public CA is OK. A CA the device trusts beyond the
+  public ones, from its image or from `custom_ca_certs`, is a **warning**: TLS
+  inspection is a supported mode, as update images are verified by digest, not
+  by trusting the connection. Any other CA is an error
+  with two ways out: exempt the registry from inspection, or have the inspection
+  CA added to the device — by its vendor, in the image, or in `custom_ca_certs`
+  where the customer manages the system configuration.
 - **Credentials** are checked by a `docker login` through the docker daemon,
   into a temporary client configuration — the daemon is what pulls the update,
   with its own TLS implementation.

system/cuos/netcheck.sh

@@ -686,7 +686,7 @@ check_cert_ca() {
       record cert_ca error "issued by an unknown CA (TLS inspection?)" \
         "The connection is probably inspected by a device whose CA this device does not trust. Two options, both supported:
 a) Exempt ${HOST} from TLS inspection.
-b) Add the CA certificate of the inspection to custom_ca_certs in the system configuration of the device.
+b) Have the CA certificate of the inspection added to the device: ask the vendor of the device to include it in its image, or, if you manage the system configuration of the device yourself, add it to custom_ca_certs.
 Note: with b) the inspection infrastructure sees this traffic, credentials included, in clear text; securing it is your responsibility."
       ;;
     *)

system/cuos/netcheck.test.sh

@@ -285,7 +285,8 @@ MOCK_SYS="60 20"
 run
 expect "unknown CA: error" "[ERROR]" line "Certificate / CA"
 expect "unknown CA: option a" "yes" has "a) Exempt registry.example.org from TLS inspection."
-expect "unknown CA: option b" "yes" has "b) Add the CA certificate of the inspection to custom_ca_certs"
+expect "unknown CA: option b, the vendor" "yes" has "vendor of the device to include it in its image"
+expect "unknown CA: option b, custom_ca_certs" "yes" has "add it to custom_ca_certs"
 expect "unknown CA: the hostname is still checked" "[OK]" line "Hostname"
 expect "unknown CA: the connection is skipped" "[SKIPPED]" line "TLS connection"