# TLS material

Production profiles require TLS **and** hostname verification; `MessageSecurityValidator` fails
startup without either.

No key material is committed here, and none should be. Certificates are issued by the deployment's
own PKI and mounted at runtime; a keystore in a repository is a credential in a repository, and
rotating it means a commit.

## Local development

The compose files in the sibling directories run plaintext listeners deliberately. They exist to
reproduce the *messaging* semantics locally, not the transport security, and running them with
`production: false` in the destination profile is what keeps the validator honest — a profile marked
`production: true` against a plaintext broker must fail, and that is a test, not an inconvenience.

## Generating a local CA for TLS testing

```bash
openssl req -x509 -newkey rsa:4096 -sha256 -days 30 -nodes \
  -keyout ca.key -out ca.crt -subj "/CN=messaging-local-ca"

openssl req -newkey rsa:4096 -nodes -keyout broker.key -out broker.csr \
  -subj "/CN=localhost"

openssl x509 -req -in broker.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out broker.crt -days 30 -sha256 \
  -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1")
```

The `subjectAltName` is not optional. Hostname verification is required in production profiles, and
a certificate without a SAN fails it — which is the correct outcome, not something to work around by
disabling the check.

Generated files are ignored by `.gitignore` in this directory.