Agent CA rotation: in-band certificate renewal + fix gem install on Ruby 2.7 - #24

Open

thdurante wants to merge 9 commits into

agent-ca-rotation

Commits on Sep 14, 2026

fix: pin timers below 4.4 so the gem installs on Ruby 2.7

thdurante
and
claude
committed
8729a20
feat: in-band certificate renewal over the agent tunnel

thdurante
and
claude
committed
d3e6e39
test: cover certificate renewal, the wire protocol and the CA bundle

thdurante
and
claude
committed
24aaab8
ci: prove the gem installs on Ruby 2.7

thdurante
and
claude
committed
6821912
docs: document certificate renewal and how to upgrade

thdurante
and
claude
committed
34ccce9
fix: verify renewed certificates for TLS client authentication

thdurante
and
claude
committed
7d7a9a2
test: assert every bundled CA is a self-issued CA:TRUE root

thdurante
and
claude
committed
d2300cc

Commits on Sep 15, 2026

docs: say the deprecated gem still receives essential fixes

thdurante
and
claude
committed
1ec521d
feat: trust the new DeployHQ Agent CA alongside the current one

thdurante
and
claude
committed
d36bd01