Ilker ManapandClaude Opus 5.5
05861bd413
The region keeps every intermediate it signs: its name constraints, certificate, the root that signed it and a renewal token (stored hashed, printed once). `rollcall ca intermediate` goes through the API now (so it works from any admin client) and writes NAME.token beside NAME.pem; `rollcall ca intermediates` lists them. The host with the intermediate's key runs deploy/rollcall-intermediate- renew.sh daily (rollcall-intermediate-renew@NAME.timer): it posts a CSR from the same key with the token to /api/v1/ca/intermediates/NAME/renew. The region signs again in the last third of the certificate's life, or at once when another root signs since a rotation's switch, always with the constraints it was first given; otherwise 204. The script checks the answer (a CA certificate for its key, from a root it holds), keeps the old file, keeps the region's roots and the active root current from /ca-bundle.pem, and reloads (RELOAD). Attention: an intermediate under 30 days from its end, whose last renewal failed or whose host has not asked for three days shows in rollcall doctor, on the web UI's overview, and one from the old root in the rotation status. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>