Harden PKI: constrain CA, fail-hard secrets, cert TTL#3

Merged

persimmon16 merged 3 commits intofeat/apple-containerfrom

security/pki-hardening

Apr 1, 2026

Commits on Apr 1, 2026

Fail hard when /dev/urandom is unavailable for secret generation
persimmon16
committed
Constrain CA pathlen to 0 and replace Docker SANs with Apple Container
persimmon16
committed
Set 365-day certificate validity instead of effectively-infinite
persimmon16
committed