Hazel Blue CA

Private certificate authority for the hazel.blue VPN. This page is informational — every real client (router, phones, laptops) uses pinned configuration and never relies on it.

Root certificate

root.pem

SHA-256 fingerprint: 055605345bcc3445afdaf6bba9105472ef19ad0859a009166f2a24bd5c642983 — verify against the value recorded in the nix-config repo before trusting a copy obtained anywhere else.

ACME directory (device-attest enrollment)

https://ca.hazel.blue:444/acme/acme-da/directory

Certificate revocation list

/1.0/crl (DER by default, ?pem for PEM)

Enrollment

iPhone — the device serial must be allowlisted in the CA policy (nix-config, deviceSerials) before enrollment; apply the MDM profile afterwards and the Secure Enclave does the rest.

Laptop — generate a hardware-bound CSR (TPM / YubiKey), have it signed on etta via step ca sign with the admin provisioner. The subject CN must be allowlisted in clientNames first.

Port 444 is the CA API (its own private chain, so a browser will warn — that is expected); this page rides the web proxy on 443 with a public certificate.