Ilker ManapandClaude Opus 5.5
77894b7d57
New roots carry path length 1. `rollcall ca intermediate` signs a CSR (or a generated key) as an intermediate limited to the permitted domains and address ranges; a root with path length 0 refuses and `rollcall ca rotate` replaces it. deploy/tags/acme-cert.yaml gets a node certificate from an ACME server under such an intermediate and renews it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>