feat(cert): client certificate lifecycle management and auto-renewal #25

Merged

ochenstarik-ui merged 2 commits from antigravity/cert-lifecycle into main

2026-08-10 05:11:17 +00:00

ochenstarik-ui commented

2026-08-09 17:33:15 +00:00

(Migrated from github.com)

Summary

Implements end-to-end client certificate lifecycle management and auto-renewal for agents and operators.

Changes Included

Control Options Configuration: Added ClientCertificateDays in ControlOptions.cs (default: 30, validated range: 1..90).
Agent Auto-Renewal: Implemented automatic mTLS certificate renewal in AgentClient.cs (EnsureCertificateRenewedAsync) when remaining lifetime is < 1/3. Swaps certificate files atomically via .tmp with 0600 permissions and falls back gracefully when Hub is offline.
Operator Background Renewal: Implemented background renewal in ControlClientService.cs for Desktop operator certificates with DPAPI re-encryption.
Endpoint Authorization Refinement:
- Removed unauthenticated duplicate endpoint app.MapPost("/api/v1/certificates/renew").
- Kept Agent renewal on agents.MapPost("/certificate/renew") requiring Agent policy.
- Added Operator renewal on control.MapPost("/certificates/renew") requiring Operator policy.
Security & Validation Tests:
- Added RenewalEndpointsRejectUnauthenticatedRequests unit test confirming 401 Unauthorized rejection for unauthenticated requests.
- Added CertificateDays45_IssuesCertificateWith45DaysValidity unit test verifying custom validity period.
Linux Trimmed Single-File Verification:
- Control__ClientCertificateDays=999 startup validation failure confirmed (OptionsValidationException).
- All 117 Control unit tests passing cleanly.

## Summary Implements end-to-end client certificate lifecycle management and auto-renewal for agents and operators. ### Changes Included 1. **Control Options Configuration**: Added `ClientCertificateDays` in `ControlOptions.cs` (default: 30, validated range: 1..90). 2. **Agent Auto-Renewal**: Implemented automatic mTLS certificate renewal in `AgentClient.cs` (`EnsureCertificateRenewedAsync`) when remaining lifetime is < 1/3. Swaps certificate files atomically via `.tmp` with 0600 permissions and falls back gracefully when Hub is offline. 3. **Operator Background Renewal**: Implemented background renewal in `ControlClientService.cs` for Desktop operator certificates with DPAPI re-encryption. 4. **Endpoint Authorization Refinement**: - Removed unauthenticated duplicate endpoint `app.MapPost("/api/v1/certificates/renew")`. - Kept Agent renewal on `agents.MapPost("/certificate/renew")` requiring `Agent` policy. - Added Operator renewal on `control.MapPost("/certificates/renew")` requiring `Operator` policy. 5. **Security & Validation Tests**: - Added `RenewalEndpointsRejectUnauthenticatedRequests` unit test confirming 401 Unauthorized rejection for unauthenticated requests. - Added `CertificateDays45_IssuesCertificateWith45DaysValidity` unit test verifying custom validity period. 6. **Linux Trimmed Single-File Verification**: - `Control__ClientCertificateDays=999` startup validation failure confirmed (`OptionsValidationException`). - All 117 Control unit tests passing cleanly.