tellent

Appearance

Local dev certificates ​

tellentCA.pem is the shared dev root CA (trusted on dev machines and, for mobile live reload, in the iOS simulator). tellent.internal.crt/.key is the server certificate used by local dev servers (webpack/certs/ holds a copy of the same cert/key pair).

Apple TLS requirements (why the leaf expires every ~2 years) ​

iOS/macOS (WKWebView, Safari) reject TLS server certificates that are valid for more than 825 days or lack extendedKeyUsage = serverAuth — even when the issuing CA is trusted. Chrome uses its own verifier and does not enforce this for private CAs, which is why a non-compliant cert can work in the browser but fail in the iOS simulator with "The certificate for this server is invalid" (NSURLError -1202).

Source — Requirements for trusted certificates in iOS 13 and macOS 10.15: "all TLS server certificates issued after July 1, 2019 […] must have a validity period of 825 days or fewer" and "must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID"; "Connections to TLS servers violating these new requirements will fail."

tellent.internal.ext encodes the compliant profile (SANs, key usage, serverAuth).

Regenerating the leaf certificate ​

Requires the tellentCA.key passphrase, stored in the Team Foundation BE vault in 1Password (requires Lumos access to that vault). The key pair is reused (the committed CSR matches tellent.internal.key), so nothing needs to be re-trusted:

bash
openssl x509 -req \
  -in certs/tellent.internal.csr \
  -CA certs/tellentCA.pem -CAkey certs/tellentCA.key \
  -CAserial certs/tellentCA.srl \
  -days 800 -sha256 \
  -extfile certs/tellent.internal.ext \
  -out certs/tellent.internal.crt
cp certs/tellent.internal.crt webpack/certs/tellent.internal.crt

Verify before committing:

bash
openssl x509 -in certs/tellent.internal.crt -noout -dates -ext extendedKeyUsage,subjectAltName
openssl verify -CAfile certs/tellentCA.pem certs/tellent.internal.crt

Commit the regenerated tellent.internal.crt (both copies) and tellentCA.srl. Restart any running dev servers afterwards — the certificate is read at startup.