ACME

Renewing the web fronts without me

Auth and access plane serves an OAuth authorization server, MCP gateways and webhook intake to the internet from an estate with no open inbound ports. Every one of those surfaces sits behind an NGINX TLS front, and I wanted each certificate to renew without me.

I chose ACME's HTTP-01 challenge for the web fronts, where a proxy already answers on port 80, and answered it on the same proxy path that carries real traffic.

The front it serves is the template for the rest, and that pattern is on the Zero-inbound network exposure page.

Minting certificates inside the agent runtime

Agent Swarm had a different problem. Agent containers and the mesh router need TLS material, their certificates belong to services with no public web front that could answer a challenge, and nobody should copy private keys between hosts.

I chose DNS-01 and wrote minting into the runtime as Rust crates. The ACME crate cleans up its challenge record on every exit, because stale challenge records otherwise pile up in the zone without anyone noticing; a failed issuance that leaves records behind becomes a slow leak.

One interface, and no key in any image

A second crate issues through the edge provider's certificate API, and both backends sit behind one interface, so code that consumes a certificate does not care which authority signed it.

Minted certificates are mounted into containers at launch and never sit in an image, so rebuilding an image can never ship a key. The internal CA the message bus trusts is covered on the TLS and mTLS page.

I treat certificate issuance as part of the platform.

I used existing ACME clients and the standard protocol; I did not write an ACME client or run a public CA.