kevinveenbirkenbachandClaude Opus 5.5
e80eec2acb
X.509 limits commonName to 64 characters, and openssl refuses a longer one while generating the CSR: ASN1_mbstring_ncopy:string too long:../crypto/asn1/a_mbstr.c:106:maxsize=64 The global leaf builds its CN as `<DOMAIN_PRIMARY upper> Global TLS`, so any primary domain longer than 53 characters fails the deploy in sys-front-tls-selfsigned. Worktree stacks hit it first: their domain is derived from the branch name (`fix-security-exec-argv-secrets-store-1153 .infinito.test` gives a 66 character CN). The CN is now truncated to 64 characters in all three branches (global, explicit subject CN, per-app primary domain). Clients verify the SAN list, not the CN, so a truncated CN changes nothing for them, and an existing certificate is only regenerated on SAN drift, as before. sys-ca-selfsigned already caps the root CA's CN. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
sys-front-tls-selfsigned
Description
Self-signed TLS provider for sys-front-tls (SAN aware).
Overview
This role self-signed TLS provider for sys-front-tls (SAN aware). Generates and stores self-signed certificates.
Cosmos
The diagram places sys-front-tls-selfsigned in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
flowchart LR
subgraph role [sys-front-tls-selfsigned 💻]
svc_tls_selfsigned["tls-selfsigned"]
end
Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.
Features
- Automated provisioning: Configured by Ansible without manual steps.
Inputs
- tls_domain
- application_id
- tls_selfsigned_base
- tls_selfsigned_days
- tls_selfsigned_key_bits
- tls_selfsigned_subject (C/O/OU/CN)
Credits
Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).