fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.

README.md

@@ -202,8 +202,9 @@ certificate; all such connections are written to `/etc/swanctl/conf.d/site-to-si
 Traffic from a connection's `local_cidrs` to its `cidrs` is not masqueraded.
 
 With `auth` `certificate`, the router authenticates with its site-to-site certificate, which the
-site-to-site issuing CA signs for `wan.local_fqdn`, the public address and the internal
-address, so it fits every `local_id_mode`. The peer's certificate must name `id` and be issued
+site-to-site issuing CA signs for `wan.local_fqdn` and for the public or the internal address
+that a connection with `auth` `certificate` uses as its identity (`local_id_mode` `public_ip` or
+`internal_ip`); it is issued again when that set of names changes. The peer's certificate must name `id` and be issued
 by the router's site-to-site CA, or by the CA of `remote_ca`. A peer with no PKI of its own gets
 its certificate from the router (template `site-to-site`, see Certificates), with the root and
 the site-to-site CA certificates as its trust anchors.
@@ -371,18 +372,27 @@ services - that is what `systemctl restart vpn-router-setup` adds.
 
 ## Certificates
 
-The router has a two-level certificate authority in `/etc/vpn-router/pki` (mode 0700), kept by
-`vpn-router-setup` and managed with `vpn-router-ca`, `vpn-router-user` and `/ca` of the status
-web service, which the Router Manager uses:
+The router has a two-level certificate authority, kept by `vpn-router-setup` and managed with
+`vpn-router-ca`, `vpn-router-user` and `/ca` of the status web service, which the Router Manager
+uses. It is held in `ou=pki,dc=vpn-router,dc=local` of the router's directory, next to the users:
 
 ```
-root/cert.pem  root/key.pem  root/crl.pem       the root CA; key.pem is absent while the root is offline
-ca/<name>/cert.pem  key.pem  crl.pem  csr.pem    an issuing CA; csr.pem while it waits for the offline root
-router/vpn-server_cert.pem  _key.pem              the router's VPN server certificate
-router/site-to-site_cert.pem  _key.pem            the router's site-to-site certificate
-users/<user>_cert.pem  _key.pem                   the users' certificates
-retired/<name>-<time>/                            the issuing CAs taken out of use
-state.json                                        the certificates issued, revocations and CRL numbers
+cn=root                       the root CA; without vpnRouterPrivateKey while the root is offline
+cn=<name>                     an issuing CA; with vpnRouterCertificateRequest while it waits for the offline root
+cn=<name>-<time>              an issuing CA taken out of use, with vpnRouterRetired
+serialNumber=<serial>,cn=<CA> a certificate the CA issued
+```
+
+A CA entry (class `vpnRouterAuthority`) has its certificate (`cACertificate;binary`), key, CRL
+(`certificateRevocationList;binary`) and CRL number. A certificate entry (class
+`vpnRouterCertificate`) has the certificate (`userCertificate;binary`), its kind (`ca`, `router`,
+`user` or `external`), template, names, expiry and revocation, and for the router's and the users'
+certificates the key. A user's certificate is also the `userCertificate` of the user's entry. No
+account of the directory reads a key (`vpnRouterPrivateKey`); only root does, through the local
+socket. `slapcat` writes the whole PKI into every backup with the users.
+
+```sh
+ldapsearch -Q -Y EXTERNAL -H ldapi:/// -b ou=pki,dc=vpn-router,dc=local -s one cn
 ```
 
 ### The CAs
@@ -403,8 +413,8 @@ The root signs the issuing CAs only (path length 1), and the issuing CAs sign th
 Once a platform is chosen, `vpn-router-setup` creates what is missing: the root when it has
 neither certificate nor key, each issuing CA, the router's certificates once `wan.local_fqdn` is
 set, and the CRLs. The names, lifetimes and key type of `pki` apply when something is created. An
-issuing CA removed from `pki.issuing_cas` is retired: its directory moves to `retired/` and its
-certificate is revoked on the root CRL. The router renews its own certificates when less than a
+issuing CA removed from `pki.issuing_cas` is retired: its entry is renamed `cn=<name>-<time>`,
+loses its key, and its certificate is revoked on the root CRL. The router renews its own certificates when less than a
 third of their lifetime is left, when the names they need change, or when their CA changes; a
 user's certificate is renewed by removing and adding the user.
 
@@ -541,9 +551,9 @@ vpn-router-ca root import-crl root.crl
 ```
 
 An existing root CA of your own is used by placing its certificate, and its key if the router may
-use it, before choosing the platform: `vpn-router-ca root import-cert root-cert.pem`, or the files
-`root/cert.pem` and `root/key.pem`. Without the key, the issuing CAs wait for their certificates
-as above.
+use it, as `/etc/vpn-router/pki/root/cert.pem` and `key.pem` before `vpn-router-setup` first runs
+with a platform, as cloud-init can. Setup imports them into the directory and removes the files.
+Without the key, the issuing CAs wait for their certificates as above.
 
 ### ACME server
 
@@ -623,7 +633,7 @@ it is added:
 
 - a VPN user, an `inetOrgPerson` with a first name, a last name and an e-mail address
   (`givenName`, `sn` and `mail`; `cn` is the first and the last name), and a client certificate
-  with the user name as its common name, in `/etc/vpn-router/pki/users`;
+  with the user name as its common name, the entry's `userCertificate`, whose key the PKI keeps;
 - a Manager-only account, an `account`, `simpleSecurityObject` and `vpnRouterAccount` with the
   name, the password and an optional e-mail address, for notifications: no names and no
   certificate, so no VPN access. It can sign in to `/auth` and, as a member of `admins`, manage
@@ -1061,6 +1071,7 @@ A change is made, checked and applied as for `/site-to-site`.
 | `POST /ca/certificates` | `{"ca", "template", "csr"}` | 201 and `{"serial", "certificate", "chain"}`, PEM |
 | `POST /ca/certificates` | `{"ca", "template", "subject", "sans", "password"}` | 201 and `{"serial", "pfx"}`, a PKCS#12 file in base64 |
 | `POST /ca/certificates/<serial>/revoke` | `{"reason"}`, optional | the certificate, with `reissue` for a router certificate |
+| `GET /ca/bundle/<name>` | | `{"name", "pem"}`: the certificates a client trusts the CA with, the root alone for `root`, the issuing CA followed by the root for an issuing CA |
 | `GET /ca/issuing/<name>/csr` | | `{"name", "csr", "extensions"}` of an issuing CA waiting for the offline root |
 | `PUT /ca/issuing/<name>/certificate` | `{"certificate"}`, PEM, signed by the root | `{"name", "subject", "expires"}` |
 | `PUT /ca/root/crl` | `{"crl"}`, PEM, signed by the root | `{"next_update"}` |
@@ -1266,12 +1277,12 @@ A backup holds the state that `vpn-router-setup` cannot make again:
 
 | Item | Content |
 |---|---|
-| `/etc/vpn-router` | `vpn-router.json`, the secrets, `rclone.conf`, and the PKI: the CAs, the root key while it is on the router, and the certificates of the router and the users |
+| `/etc/vpn-router` | `vpn-router.json`, the secrets and `rclone.conf` |
 | `/etc/wireguard` | The WireGuard keys and the peers |
 | `/etc/ufw`, `/etc/default/ufw` | The firewall rules |
 | `/etc/vpn-router-manager` | The Router Manager's settings, when it is installed |
 | `files/<path>` | Each `psk_file` outside `/etc/vpn-router` |
-| `ldap/vpn-router.ldif` | The user directory, written by `slapcat`: users, groups, service accounts, password hashes and TOTP secrets |
+| `ldap/vpn-router.ldif` | The user directory, written by `slapcat`: users, groups, service accounts, password hashes and TOTP secrets, and the PKI: the CAs and their keys, the root key while it is on the router, and the certificates issued, with the keys of the router's and the users' certificates |
 | `postgresql/vpn-router.dump` | With `backup.metrics`, the database of the metrics and the refresh tokens, written by `pg_dump -Fc` |
 | `manifest.json` | The host, the time, the version of the package, the schedule and the items |
 
@@ -1373,8 +1384,8 @@ file when the package created them, and Caddy's configuration `/etc/caddy/vpn-ro
 `/var/lib/caddy` belongs to the `caddy` package. It removes the backup timer's schedule, the
 record of the last backup, the published CA files, the copies of the ACME CAs in
 `/etc/caddy/vpn-router-pki` and OpenVPN's CA and CRL files. Caddy stays installed, and with it the
-source of Caddy's repository. Key material, users and backups are never deleted: `/etc/vpn-router/pki`,
-`/etc/vpn-router/ldap`, `/etc/vpn-router/rclone.conf`, the user directory in slapd, the WireGuard
+source of Caddy's repository. Key material, users and backups are never deleted:
+`/etc/vpn-router/ldap`, `/etc/vpn-router/rclone.conf`, the user directory in slapd with the PKI, the WireGuard
 key pair, everything under `/etc/swanctl`, the archives in `backup.path` and
 `/var/lib/vpn-router/backup/before-restore` are left alone.