coulomb/railiance-cluster
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RCLUSTER-WP-0018-T04: production reissue receipt for the NK49 attempt
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-23 19:40:16 +02:00
parent 88b360bde6
commit 0f650b45bc
1 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/keycape-tls-le-prod-nk49-attempt.md
View file

@ -94,3 +94,26 @@ outside `tls-attempt-kc`; DNS or port 80 fails; the Certificate is not Ready in
tls-attempt-kc describe challenge` first); the issuer CN contains `(STAGING)`;
`openssl verify` is not `OK`; the public-key hashes differ; or the live
fingerprint or `sso/kc-tls` resourceVersion changes.
## Production reissue receipt (2026-10-23, attended by the founder)
Run from railiance-cluster `88b360b` with the admin kubeconfig, inside the NK49
T40 window. Certificate Ready and Order `valid` on the first order (37 s, no retry).
| Check | Result |
| --- | --- |
| Issuer | `C = US, O = Let's Encrypt, CN = YR2` (production) |
| Subject / SAN | `CN = kc.coulomb.social` / `DNS:kc.coulomb.social` |
| Validity | 2026-10-23T16:23:09Z to 2027-01-21T16:23:08Z |
| `openssl verify` against ISRG Root X1 | `OK` |
| `tls_cert_sha256` (chain, public) | `0dd5d58264b552cfdffac6c003dddb789762ea6ba1013e0965c7979588135add` |
| `leaf_public_spki_sha256` | `sha256:044daa6b300e8dc2a83bdac90e3a6df5d96c40a430c52043b69e2b9c4f188b0b` |
| `trust_sha256` (ISRG Root X1) | `22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1` |
| Certificate/key public-key hashes | equal (`e4ced1bc…6de8`) |
| Live fingerprint / `sso/kc-tls` resourceVersion | `D5:DB:2B:55…CE:5C` / `66444692`, unchanged |
| Cleanup | namespace deleted, no solver ingress left |
The exported key was used only as NK49 launcher input (NK-WP-0049-T18, verified
receipt `16d72f7c…1651`) and is then destroyed by the founder. This reissue used
one of the 5-per-week duplicate-certificate allowance. It is not original-key
recovery and not a change to live TLS.