Add TLSA names directive to publish records under explicit domains #18

2026-10-09T17:10:47Z

mona Bot commented

2026-10-09 17:10:47 +00:00

Add a names NAME... directive to the tlsa block so TLSA records can be published under explicit (sub)domains instead of the certificate's names.

Replacement semantics: when set, records publish only under the configured names; when omitted, the certificate's names are used as before
Wildcard prefixes are stripped like certificate names; IP literals are rejected as owner names
Records previously published under other names are removed automatically on the next reconcile via the existing published-record drift cleanup
gibcert show displays the configured names
Docs updated (docs/configuration.md, docs/man/gibcert.scfg.5) and CHANGELOG entry added

Closes #17

Add a `names NAME...` directive to the `tlsa` block so TLSA records can be published under explicit (sub)domains instead of the certificate's names. - Replacement semantics: when set, records publish only under the configured names; when omitted, the certificate's names are used as before - Wildcard prefixes are stripped like certificate names; IP literals are rejected as owner names - Records previously published under other names are removed automatically on the next reconcile via the existing published-record drift cleanup - `gibcert show` displays the configured names - Docs updated (`docs/configuration.md`, `docs/man/gibcert.scfg.5`) and CHANGELOG entry added Closes #17

mona Bot added 1 commit 2026-10-09 17:10:47 +00:00

Add TLSA names directive to publish records under explicit domains 101acd83ad

Add a names NAME... directive to the tlsa block so TLSA records can be
published under explicit (sub)domains instead of the certificate's
names. When omitted, the previous behavior is unchanged. Wildcard
prefixes are stripped like certificate names, IP literals are rejected,
records previously published under other names are removed automatically
on reconcile, and gibcert show displays the configured names.

Fixes #17

Co-Authored-By: Z.ai GLM (glm-5.3) <noreply@z.ai>

kruno added 1 commit 2026-10-09 17:42:20 +00:00

Reconcile TLSA owner changes and publish TLSA for local CA certificates ee4a806548

Follow-up to the tlsa names directive from review:

- plan, apply, and renew compare the owners recorded as published with
  the configured tlsa names and ports, and republish from stored
  material when they differ or nothing was published yet, instead of
  waiting for the next renewal. TLSA plan actions require confirmation.
- Compute TLSA owners once in config, lowercase them, and compare owners
  case-insensitively when removing stale records, so a case-only change
  no longer deletes records that were just republished.
- Reject wildcard names in tlsa names instead of silently stripping them.
- Local CA signing selects the TLSA rotation key, promotes the staged
  next key, keeps TLSA metadata, and publishes the records; it
  previously skipped TLSA entirely.
- Correct the docs and changelog, move the names example out of the main
  tlsa example, and describe when gibcert tlsa reconcile is still needed.

Co-Authored-By: Anthropic Claude (claude-opus-5-5) <noreply@anthropic.com>

mona Bot merged commit 208d63a500 into main

2026-10-09 17:42:52 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: fsky/gibcert#18