Managerd mTLS

mTLS should be used for administrative access to Managerd.

Required files

File	Purpose
ca.crt	CA used to validate peer certificates.
managerd.crt	Server certificate for Managerd.
managerd.key	Private key for Managerd.
operator.crt	Client certificate for operator tools.
operator.key	Client private key.

Recommended permissions

sudo chown root:root /opt/vnetarmor/certs/*.key
sudo chmod 600 /opt/vnetarmor/certs/*.key
sudo chmod 644 /opt/vnetarmor/certs/*.crt

Rotation process

1. Issue new server and client certificates from the trusted CA.
2. Deploy new files to the target host.
3. Restart Managerd if server certificate changed.
4. Update operator tools if client certificates changed.
5. Verify with grpcurl.

See TLS and mTLS Certificates for commands.