Repository navigation
T51 — Rotate a running proxy's signing certificate through the control socket #2532
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Conditions closed | M | needs care | standard | an agent | 360 (220 code, 140 tests) |
An operator rotates the serving proxy's signing certificate now, and a leaf issued before and one issued after both validate against the root a box holds.
Covers:
- BEP-061
Layers:
- control:
- crates/bep/src/control.rs: accepts a rotate-signing request from the host and runs
Ca::renew_signingon the serving proxy's CA under the same root and key identifier - crates/bep/src/main.rs:
bep rotate-signingsends the request over the control socket and prints the result cargo nextest run -p bep rotate_signing_over_control_socket_keeps_leaves_valid
- crates/bep/src/control.rs: accepts a rotate-signing request from the host and runs
Waits on:
Implements the filed residual #2509; those issues close with this task and do not block it.
Plan block
### T51 — Rotate a running proxy's signing certificate through the control socket
slice: S9
kind: task
covers: BEP-061
size: M
est: 220 code, 140 tests
executor: agent
difficulty: needs care
model: standard
diagnostics: the command prints one line naming the old and new signing fingerprints, and the proxy's info log line records the same rotation
observability: the info log line T36 added, for operator-driven and scheduled rotations alike
layers:
- control:
- crates/bep/src/control.rs: accepts a rotate-signing request from the host and runs `Ca::renew_signing` on the serving proxy's CA under the same root and key identifier
- crates/bep/src/main.rs: `bep rotate-signing` sends the request over the control socket and prints the result
test: cargo nextest run -p bep rotate_signing_over_control_socket_keeps_leaves_valid
produces: none
consumes: none
proof: An operator rotates the serving proxy's signing certificate now, and a leaf issued before and one issued after both validate against the root a box holds.
depends on:
- blocked by T36
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2545 merged.
branch
agent/2532-rotate-a-running-proxy-s-signing-certificate-thr· epic #1501 · PR #2545Updated 2026-10-25T05:10:28.697Z.