[PR #168] [MERGED] fix: remove CA private key after certificate signing in entrypoint #208

New Issue

2026-06-06T22:09:42-04:00

yindo commented

2026-06-06 22:09:42 -04:00

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/168
Author: @mason5052
Created: 3/2/2026
Status: ✅ Merged
Merged: 3/2/2026
Merged by: @asdek

Base: feature/next_release ← Head: fix/entrypoint-ca-key-cleanup

📝 Commits (1)

5563001 fix: remove CA private key after certificate signing in entrypoint

📊 Changes

1 file changed (+5 additions, -1 deletions)

View changed files

📝 scripts/entrypoint.sh (+5 -1)

📄 Description

Description of the Change

Problem

The entrypoint script (scripts/entrypoint.sh) generates a self-signed CA to issue the server certificate at startup. After signing, the CA private key (ssl/service_ca.key), CSR (ssl/service.csr), and serial file (ssl/service_ca.srl) remain on disk inside the container.

These files are never used again at runtime -- the server only needs server.key and server.crt (which already includes the CA cert appended). Leaving the CA private key on disk increases the attack surface: if the container filesystem is compromised (e.g., via a path traversal or container escape), an attacker could use the CA key to issue arbitrary certificates trusted by the server's certificate chain.

The script also runs chmod g+r on the CA key, which widens read access to a file that should not exist at all after signing.

Solution

Replace chmod g+r ${SERVER_SSL_CA_KEY} with rm -f to delete the CA private key, CSR, and serial file immediately after the server certificate is signed.

Type of Change

Bug fix (non-breaking change which fixes an issue)

Areas Affected

Infrastructure (Docker/Kubernetes Configuration)

Testing and Verification

Test Configuration

PentAGI Version: master @ e97bbe5
Docker Version: N/A (shell script review)
Host OS: Windows 11
LLM Provider: N/A

Test Steps

Verified the CA key is only used during the openssl x509 -req signing step
Confirmed the CA certificate is already appended to server.crt (cat ${SERVER_SSL_CA_CRT} >> ${SERVER_SSL_CRT})
Verified no other script or code references service_ca.key after entrypoint
Confirmed service.csr and service_ca.srl are also not used after signing

Test Results

After the fix, only server.key, server.crt, and service_ca.crt (public cert, needed in the chain) remain
The CA private key, CSR, and serial number file are removed
No functional change to the server's TLS behavior

Security Considerations

This fix reduces attack surface by removing cryptographic key material that is no longer needed:

CA private key: Could be used to issue arbitrary certificates if exfiltrated
CSR: Contains the server's public key and subject info (low risk, but unnecessary)
Serial file: Contains the serial number counter (low risk, but unnecessary)

Performance Impact

None. rm -f of 3 small files at startup is negligible.

Deployment Notes

Backward-compatible. Existing containers will clean up the CA key on next restart when SERVER_USE_SSL=true and certificates are regenerated. If certificates already exist (the if branch), no change in behavior.

Checklist

Code Quality

My code follows the project's coding standards
I have added/updated necessary documentation
All new and existing tests pass

Security

I have considered security implications
Changes maintain or improve the security model
Sensitive information has been properly handled

Compatibility

Changes are backward compatible
Dependencies are properly updated

Documentation

Documentation is clear and complete
Comments are added for non-obvious code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/168 **Author:** [@mason5052](https://github.com/mason5052) **Created:** 3/2/2026 **Status:** ✅ Merged **Merged:** 3/2/2026 **Merged by:** [@asdek](https://github.com/asdek) **Base:** `feature/next_release` ← **Head:** `fix/entrypoint-ca-key-cleanup` --- ### 📝 Commits (1) - [`5563001`](https://github.com/vxcontrol/pentagi/commit/55630014d39745dbaea7ee7dadfce0827f7649fe) fix: remove CA private key after certificate signing in entrypoint ### 📊 Changes **1 file changed** (+5 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `scripts/entrypoint.sh` (+5 -1) </details> ### 📄 Description ### Description of the Change #### Problem The entrypoint script (`scripts/entrypoint.sh`) generates a self-signed CA to issue the server certificate at startup. After signing, the CA private key (`ssl/service_ca.key`), CSR (`ssl/service.csr`), and serial file (`ssl/service_ca.srl`) remain on disk inside the container. These files are never used again at runtime -- the server only needs `server.key` and `server.crt` (which already includes the CA cert appended). Leaving the CA private key on disk increases the attack surface: if the container filesystem is compromised (e.g., via a path traversal or container escape), an attacker could use the CA key to issue arbitrary certificates trusted by the server's certificate chain. The script also runs `chmod g+r` on the CA key, which widens read access to a file that should not exist at all after signing. #### Solution Replace `chmod g+r ${SERVER_SSL_CA_KEY}` with `rm -f` to delete the CA private key, CSR, and serial file immediately after the server certificate is signed. ### Type of Change - [x] Bug fix (non-breaking change which fixes an issue) ### Areas Affected - [x] Infrastructure (Docker/Kubernetes Configuration) ### Testing and Verification #### Test Configuration ```yaml PentAGI Version: master @ e97bbe5 Docker Version: N/A (shell script review) Host OS: Windows 11 LLM Provider: N/A ``` #### Test Steps 1. Verified the CA key is only used during the `openssl x509 -req` signing step 2. Confirmed the CA certificate is already appended to `server.crt` (`cat ${SERVER_SSL_CA_CRT} >> ${SERVER_SSL_CRT}`) 3. Verified no other script or code references `service_ca.key` after entrypoint 4. Confirmed `service.csr` and `service_ca.srl` are also not used after signing #### Test Results - After the fix, only `server.key`, `server.crt`, and `service_ca.crt` (public cert, needed in the chain) remain - The CA private key, CSR, and serial number file are removed - No functional change to the server's TLS behavior ### Security Considerations This fix **reduces attack surface** by removing cryptographic key material that is no longer needed: - **CA private key**: Could be used to issue arbitrary certificates if exfiltrated - **CSR**: Contains the server's public key and subject info (low risk, but unnecessary) - **Serial file**: Contains the serial number counter (low risk, but unnecessary) ### Performance Impact None. `rm -f` of 3 small files at startup is negligible. ### Deployment Notes Backward-compatible. Existing containers will clean up the CA key on next restart when `SERVER_USE_SSL=true` and certificates are regenerated. If certificates already exist (the `if` branch), no change in behavior. ### Checklist #### Code Quality - [x] My code follows the project's coding standards - [x] I have added/updated necessary documentation - [x] All new and existing tests pass #### Security - [x] I have considered security implications - [x] Changes maintain or improve the security model - [x] Sensitive information has been properly handled #### Compatibility - [x] Changes are backward compatible - [x] Dependencies are properly updated #### Documentation - [x] Documentation is clear and complete - [x] Comments are added for non-obvious code --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 22:09:42 -04:00

yindo closed this issue

2026-06-06 22:09:42 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: vxcontrol/pentagi#208