Generate random 256-bit secret stored in /var/lib/certauth/.jwt_secret (mode 0600) ENV JWT_SECRET takes precedence. Remove CHANGE_ME_JWT_SECRET default. Add tests for secret generation and env override
Description
Self-contained certificate authority with YubiKey-backed signing. Root + intermediate CA keys on two YubiKeys; every signing requires physical touch + PIN.
Languages
Python
47.1%
HTML
27.3%
Shell
25.6%