jbpratt ef28623b87 NO-ISSUE: fix(mirror-registry): issue generated TLS cert from a discarded CA (#7752) ...

* NO-ISSUE: fix(mirror-registry): issue generated TLS cert from a discarded CA

The generated ssl.cert was self-signed CA:TRUE with keyCertSign and ssl.key
beside it, so anyone holding the key could sign a cert for any host that
clients trusting ssl.cert would accept.

The leaf is now signed by an ephemeral CA:TRUE, pathlen:0 CA name-constrained
to the registry hostname (IP SANs only for an IP host), whose key is never
written. Clients trust rootCA.pem, which the install output names for
generated certs; update-ca-trust keeps the anchor since it is a CA. Existing
installs and user-supplied certs are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* NO-ISSUE: fix(mirror-registry): drop generated rootCA.pem when a user cert is installed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-19 15:15:52 -05:00

..

option.go

PROJQUAY-10636: feat(cmd): add quay serve/install commands (#5693)

2026-05-31 18:58:45 -05:00

server.go

PROJQUAY-12511: feat(tls): add SSL_PROTOCOLS config support (#6737)

2026-08-05 14:30:10 -05:00

tls.go

NO-ISSUE: fix(mirror-registry): issue generated TLS cert from a discarded CA (#7752)

2026-10-19 15:15:52 -05:00