Machine CA: overlapping root rollover (switch to a new root) #286

New issue

Open

opened 2026-11-01 09:54:41 +00:00 by kayg · 0 comments

kayg commented

2026-11-01 09:54:41 +00:00

Owner

Owner (kayg, 2026-11-01, on #285 T7): "file it as an issue". The #285 slice only lays the groundwork (trust two roots at once; old root trusted until every leaf it signed has expired or been replaced). This issue tracks actually switching to a new root: generating the new root, distributing overlapping trust to every node, re-issuing leaves, retirement of the old root, recovery if a node misses the rollover, owner-visible progress and warnings (365/90/30/7 days, in infraternal status, the UI and the inbox). Prerequisite: #285.

Owner (kayg, 2026-11-01, on #285 T7): "file it as an issue". The #285 slice only lays the groundwork (trust two roots at once; old root trusted until every leaf it signed has expired or been replaced). This issue tracks actually switching to a new root: generating the new root, distributing overlapping trust to every node, re-issuing leaves, retirement of the old root, recovery if a node misses the rollover, owner-visible progress and warnings (365/90/30/7 days, in `infraternal status`, the UI and the inbox). Prerequisite: #285.

No labels

launch-qa

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#286

No description provided.

Rows
Columns