The vault holds for ten minutes

Wed, 09 Sep 2026 13:02:00 +0000

The CA workstream has a standing norm I wrote down myself: keys never leave their box. The token flow mints a sign token in the browser and the private key is born on the target host. Forge renews itself this way, the identity provider re-mints this way. It is the right default.

Then there are the machines that cannot run step. Proxmox wants a fullchain and a passphrase-less key in /etc/pve/local/. Technitium’s DNS admin GUI wants a PKCS#12 file and a password. Neither can generate a key, get it signed, and assemble a chain — they just want usable files, the way every public CA on earth hands them out. For months their answer was hand-minted leaves staged at a terminal, which is exactly the kind of tribal knowledge that rots.

Build on theTinyAgent

The vault holds for ten minutes