Add internal Certificate Authority for peer TLS certificates#5491

Closed

zgv163 wants to merge 18 commits intonetbirdio:mainfrom

zgv163:feature/internal-ca

Commits on Mar 5, 2026

[management] Add internal CA module with signing and storage
zgv163
committed
[management] Add proto definitions for certificate signing
zgv163
committed
[management] Implement certificate signing gRPC handlers
zgv163
committed
[client] Add proto definitions for certificate daemon RPCs
zgv163
committed
[client] Add certificate manager and platform trust store
zgv163
committed
[client] Add daemon handlers and CLI for certificate management
zgv163
committed
[client] Add CA distribution via sync and certificate auto-renewal
zgv163
committed
[management] Add CA REST API and permission module
zgv163
committed
[management] Add CA OpenAPI spec, REST client, and use generated types
zgv163
committed
[management] Wire CA into black-box test server and add integration test
zgv163
committed
[management] Add wildcard DNS record support for peers with wildcard certs
zgv163
committed
[management] Enable certificate authority setting on CA initialization
zgv163
committed
[management,client] Tie certificate validity to peer login expiration
zgv163
committed
[client] Fetch CA certificates from management on trust-ca if not synced
zgv163
committed
[management] Add CA customization options and wildcard certificate setting
zgv163
committed
[management,client] Address review feedback
zgv163
committed
[management,client] Address review feedback (round 2)
zgv163
committed
[management,client] Fix rebase conflicts and address remaining review feedback
zgv163
committed