Module enrollment 

Bootstrap enrollment + cert renewal. Both flows sign the CSR with the host’s SSH ed25519 key (RFC-0003 §2); the agent never generates keys.

Modules

pem 🔒

Functions

cert_remaining_fraction

Returns (remaining_fraction, not_after); < 0.5 means time to renew.

enroll

fingerprint_pubkey_raw

base64 SHA-256 of raw pubkey bytes; matches CP’s expected_pubkey_fingerprint field on the bootstrap token.

generate_csr_from_ssh_host_key

Builds a CSR signed by the SSH host key; returns (PEM CSR, raw 32-byte pubkey). CP rejects if the pubkey doesn’t match hosts.<hostname>.pubkey. FOOTGUN: SSH key is OpenSSH PEM; rcgen wants PKCS#8 - we rewrap via the proto helper before handing to KeyPair::from_pem.

renew

write_atomic 🔒

Tempfile + rename so a crash mid-write doesn’t leave a half-written cert.