# The lab CA and broker certificate

`generate-tls.sh` writes the certificate material here:

| File | Purpose | Who gets it |
|---|---|---|
| `ca.crt` | the lab CA certificate | every device and the Control Service |
| `ca.key` | the CA private key | **not** a device; keep it off-device |
| `server.crt` | the broker certificate | the broker |
| `server.key` | the broker private key | the broker |

Everything in this directory except this README is gitignored: certificates and
keys are generated per host and never committed.

```bash
make mqtt-tls          # writes the four files (skips them if they exist)
make mqtt-tls-force    # use generate-tls.sh --force to replace them
```

The broker runs as user `mosquitto` (uid 1883) inside its container, and this
directory is bind-mounted read-only, so the files are created mode **0644**. That
makes the private keys readable on `.13` by any local user. It is the pragmatic
choice for a LAN-only broker whose key must be readable by a container user that
does not exist on the host. Replace it with a group-mapped setup if `.13` ever
gets untrusted local users.