Module cert_ledger 

Daemon-owned issued-certificate ledger.

The single canonical record of which device holds which client certificate (device id + SHA-256 fingerprint + validity + status), the join key back to the gateway pairing devices.db (token_hash), and the choke point that writes the append-only certificate audit trail. The daemon owns the CA, so it owns this ledger; when the gateway is present it READS the ledger (one store, two readers - no third device store, per AGENTS.md no-duplicate-state).

Issuance is a two-phase commit across those two stores: the row lands in a pending state that NO reader treats as a credential, and is promoted to its final status only once the completion audit event is durable. A row this ledger vouches for therefore always has a matching completion event, and every failure mode - including a process that dies mid-issuance - leaves at most a pending row, which the next open reconciles away (CertLedger::record_issued).

Promotion happens BEFORE the certificate reaches its keyholder, so delivery is tracked as a second, explicitly reconciled dimension: delivered_at, set by CertLedger::mark_delivered at the real delivery/publication boundary and swept by reconcile_undelivered_issuances at the first issuance, ledger open, or explicit CertLedger::sweep_undelivered_certificates after the TTL elapses (not on a timer - see that function for the residual). See CertLedger::record_issued for why promotion-before-delivery is the deliberately chosen failure direction.

Revocation is sourced here. The renew RPC (cert/renew) refuses a revoked-but-unexpired cert immediately by consulting CertLedger::status_of (threat A5). The WSS handshake-time refusal is wired separately against this ledger via CertLedger::revoked_fingerprints / CertLedger::is_revoked.

Structs

CertLedger

The daemon’s issued-certificate ledger over SQLite (<data_dir>/tls/ledger.db).

LedgerEntry

A row in the issued-cert ledger.

Enums

CertStatus

Status of an issued certificate the ledger vouches for.

IssuanceActor

How an issuance was authorized; controls the audit actor semantics so the primary (self-service enrollment) path is never recorded with a blank actor.

Constants

ISSUANCE_PRECONDITION_FAILED

Marker carried in the error chain when an issuance is refused because its precondition no longer holds - a renewal whose certificate was revoked while the renewal was in flight.

Functions

effective_revoked_list_path

The revoked-fingerprint list the WSS verifier will actually read: the operator’s [wss.client_auth].crl_path when set, otherwise the ledger default under <data_dir>/tls/revoked.

revoked_list_path

The revoked-fingerprint list the daemon’s WSS mTLS verifier reads for connect-time revocation refusal (A5). The ledger materializes it on revoke.