Ilker ManapandClaude Opus 5.5
a25b5c1f33
rollcall-ca-refresh reports a server it no longer trusts (the rotation went past prepare before the machine refreshed) instead of exiting quietly; the README asks for a day between prepare and switch. The status lists admin certificates from before the switch, and retire prints them: they stop working with the old root. Tested end to end in the lab: prepare, switch and retire on pxe-server with pxe-rack2 following without a new join (bundle installed by its root unit, client and server certificates renewed), node001 (Debian) and node002 (Rocky) moving to the new root with the refresh timer, and the netops Caddy intermediate signed again by the new root. Closes #12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>