kevinveenbirkenbachandClaude Opus 5.5 e80eec2acb fix(tls-selfsigned): cap the leaf certificate CN at 64 characters ...

X.509 limits commonName to 64 characters, and openssl refuses a longer
one while generating the CSR:

  ASN1_mbstring_ncopy:string too long:../crypto/asn1/a_mbstr.c:106:maxsize=64

The global leaf builds its CN as `<DOMAIN_PRIMARY upper> Global TLS`, so
any primary domain longer than 53 characters fails the deploy in
sys-front-tls-selfsigned. Worktree stacks hit it first: their domain is
derived from the branch name (`fix-security-exec-argv-secrets-store-1153
.infinito.test` gives a 66 character CN).

The CN is now truncated to 64 characters in all three branches (global,
explicit subject CN, per-app primary domain). Clients verify the SAN
list, not the CN, so a truncated CN changes nothing for them, and an
existing certificate is only regenerated on SAN drift, as before.
sys-ca-selfsigned already caps the root CA's CN.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-24 21:04:10 +02:00

..

00_core.yml

fix(tls-selfsigned): cap the leaf certificate CN at 64 characters

2026-10-24 21:04:10 +02:00

01_generate_leaf.yml

…

main.yml

…