TLS Cert Automation #

Every certificate the site serves chains to the Deevnet Root CA, kept offline with the Mobile Site CA ( ADR-0031, CHG-0033). The Mobile Substrate CA signs every substrate certificate on the control node, OpenBao’s listener included, and certs.yml renews them. The Builder, the hypervisors and every management-plane VM trust the root at the OS level; tenants trust it as deevnet-root-ca.pem. Proxmox, the core router and the Omada controller serve site certificates, and every client verifies them ( Certificates). The Tenant Device CA is in OpenBao, waiting for device enrollment.

Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned

Value objectives: Works anywhere, One part-time operator can run it, Secure by default

• ✅ Deevnet’s own root and site certificate authorities created and kept offline (CHG-0033) 2026-10-05
• ✅ Tenant certificate authorities’ keys generated outside the OpenBao secrets manager (CHG-0036) 2026-10-25
• ✅ Every machine the site builds trusts the Deevnet root certificate 2026-10-05
• 🔄 Tenant VMs that trust only the retired root certificate replaced
• ✅ Every infrastructure service and appliance on the site serves a Deevnet certificate, and its clients verify it 2026-10-05
• ⏳ IoT devices get their own certificates through the Deevnet API and use them to log in to the MQTT broker
• ⏳ Automatic certificate renewal, expiry monitoring, and a clean new root once device certificates work

Project plan: TLS Cert Automation