- Ya
- 23 Agosti 2026, 02:39 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 0acadf2
Certificates are minted one per FQDN -- a single dnsName each, so the leaf CN matches the hostname the browser connected to -- and auto-cert works through an org's hosts serially. Both the verify-dns endpoint and the background domain watcher stopped at the first host that answered, which was internal: roughly five hosts into an eleven-host run. That set ssl_confirmed, /setup/dns unlocked Enter Workspace on it, and the customer landed in a workspace where login, register, sign, theme and the rest were still serving Traefik's self-signed default -- ERR_CERT_AUTHORITY_INVALID everywhere, with the setup page insisting the domain was verified. probeAll() now asks every host, concurrently so the fan-out costs one timeout rather than eleven, and allIssued() requires all of them (an empty result is false, since allMatch over nothing is vacuously true). Hosts that come back bare are re-seeded over plain HTTP: auto-cert discovers hostnames only from Traefik's access log and keeps five minutes of it, so a host whose earlier seed aged out before auto-cert reached it would otherwise wait forever -- and it cannot bootstrap itself, because with no certificate the browser aborts at the handshake and never sends a request to log. verify-dns also returns per-host state so the setup page can name what is still pending instead of showing an unchanging spinner.