Ilker ManapandClaude Opus 5.5
a495c33b66
Renewal could not work: rack join writes the certificate and key as root, and the rack (user rollcall) failed to overwrite them. A lost renewal answer also locked the rack out, since the region accepted only the new serial. - the renewed certificate and key go into one file in /var/lib/rollcall/rack-cert (cert_state_dir), written atomically, and are preferred at start when they are this rack's, from the CA, newer - after a renewal the region accepts the previous serial for 7 days; a new join does not keep it - rollcall rack renew renews now (run as the service user) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>