v0.2.3

Profiled keys are private to their owner unless a group is named

ghcr.io/certpilot/agent:0.2.3     linux/amd64, linux/arm64
go install github.com/certpilot/certpilot-agent/cmd@v0.2.3

A profile writes the private key 0600 unless the destination names a group (#7).

• The problem: the nginx, Apache, HAProxy, Caddy and Tomcat profiles wrote the key 0640 whether or not a group was named. With no group, that made the key readable by every member of the owner's group. The core's own inventory flags a key like that as private_key_readable, CRITICAL, so a host set up by the documented profile reported itself as exposed.
• What the agent does now: it writes the key 0600, or 0640 when the destination names a group, because naming one says which group should read it. An explicit key_mode is still obeyed exactly. certpilot-agent profiles and the nginx and HAProxy guides say the same.
• Existing hosts: a key already on disk keeps its mode until the next install replaces the file.

Verified with real services: nginx, Apache, HAProxy, Caddy and Tomcat each loaded a certificate the agent installed, with the key at 0600.

A renewal tells the core which certificate it replaces (#8).

The agent now sends renews with the ID of the certificate it holds. Core v0.2.1 uses it to update that record rather than add a second one (certpilot/certpilot#127). Core v0.2.0 ignores the field, so this agent works with it as before.

Verified end to end on an nginx host, against a core built from certpilot/certpilot#127: renewing with this agent kept one certificate record and raised its renewal count.

Known issues: none open against the agent.