From 7b3f7f53dc8d7c75b414e6a0daeea205b0fbfe4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anders=20=C3=85slund?= <anders.aslund@teknoir.ai>
Date: Sun, 11 Oct 2026 17:20:03 +0000
Subject: [PATCH 1/2] fix(bootstrap): root CA with keyCertSign; tn-k3s-ca.sh
 setup, check and remediate

k3s v1.34.12/v1.35.9/v1.36.5/v1.37.1 and later (k3s-io/k3s#14699) drop CA
bundle certificates without keyCertSign. server.sh.tmpl copied the device
certificate (rsa_public.pem, never a CA with keyCertSign) verbatim to
server/tls/root-ca.pem, so a new device hangs on 'CA cert validation failed'
and an existing one bricks on a k3s upgrade.

pkg/templates/scripts/tn-k3s-ca.sh (POSIX sh, embedded in server.sh.tmpl,
also usable stand-alone):

- tn_k3s_ca_setup: re-issues the device certificate as the root from the
  SAME key, subject and subject key identifier (CA:TRUE, keyCertSign, 20
  years), then issues the intermediate and the five leaf CAs as before. k3s
  never started: PKI created (a valid one is kept). k3s started and the root
  is fine: nothing is touched. k3s started and the root is old: repaired with
  rotate-ca before the unpinned k3s installer runs
  (TN_K3S_CA_AUTO_REMEDIATE=false stops with advice instead).
- check: exit 0 ok / 2 needs rotation / 3 needs regeneration / 4 foreign CA.
- remediate [--phase prepare|rotate|finalize|all]: stages the new bundles,
  runs k3s certificate rotate-ca against the running server (works on a
  post-fix server that refuses the old root, via SSL_CERT_FILE), copies the
  files, restarts k3s. A datastore that k3s never initialised (hung fresh
  bootstrap: no server/token, rotate-ca fails with 'token must not be empty')
  has nothing to rotate: the PKI is regenerated in place. rotate-ca gets
  --force only when the old root cannot vouch for the chain (expired, or a
  keyUsage without keyCertSign); the new bundle is verified with openssl first.
- Does not change shell options, traps or the working directory of the
  caller (the old inline block overwrote the script's EXIT trap and cd'ed into
  server/tls), works under set -e and noglob, CN capped at 64 characters
  (long device names broke 'openssl req' before).

Tests: pkg/templates/k3sca_test.go (openssl, fake k3s), docs (troubleshooting,
bootstrap), a CI workflow (unit tests on PRs, docker matrix on dispatch). The
docker harness in test/k3s-ca runs the library against real k3s releases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/k3s-ca.yml         |  64 +++
 docs/commands/bootstrap.md           |  21 +
 docs/troubleshooting.md              |  73 ++++
 pkg/templates/bootstrap_templates.go |  10 +
 pkg/templates/k3sca_test.go          | 589 +++++++++++++++++++++++++
 pkg/templates/scripts/tn-k3s-ca.sh   | 628 +++++++++++++++++++++++++++
 pkg/templates/server.sh.tmpl         | 113 +----
 7 files changed, 1393 insertions(+), 105 deletions(-)
 create mode 100644 .github/workflows/k3s-ca.yml
 create mode 100644 pkg/templates/k3sca_test.go
 create mode 100644 pkg/templates/scripts/tn-k3s-ca.sh

diff --git a/.github/workflows/k3s-ca.yml b/.github/workflows/k3s-ca.yml
new file mode 100644
index 0000000..381bf76
--- /dev/null
+++ b/.github/workflows/k3s-ca.yml
@@ -0,0 +1,64 @@
+name: k3s-ca
+
+# The k3s custom-CA library (pkg/templates/scripts/tn-k3s-ca.sh) and its harness.
+# Unit tests run on every change; the docker matrix against real rancher/k3s
+# releases is started by hand (it needs privileged containers and several minutes).
+
+on:
+  pull_request:
+    paths:
+      - 'pkg/templates/**'
+      - 'test/k3s-ca/**'
+      - '.github/workflows/k3s-ca.yml'
+  workflow_dispatch:
+    inputs:
+      suites:
+        description: 'run.sh --suite value'
+        default: 'fresh,remediation'
+      versions:
+        description: 'k3s versions (space separated)'
+        default: 'v1.34.11 v1.36.5'
+
+permissions:
+  contents: read
+
+jobs:
+  unit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: true
+      - name: shellcheck
+        run: |
+          shellcheck -s sh -S warning pkg/templates/scripts/tn-k3s-ca.sh
+      - name: go test
+        run: go test ./pkg/templates/... ./test/k3s-ca/...
+
+  docker-matrix:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: true
+      - name: run the harness
+        env:
+          TN_K3S_CA_LIB: ${{ github.workspace }}/pkg/templates/scripts/tn-k3s-ca.sh
+          SUITES: ${{ inputs.suites }}
+          VERSIONS: ${{ inputs.versions }}
+        run: |
+          test/k3s-ca/run.sh --suite "$SUITES" --versions "$VERSIONS" --gens bs-o111 -j 3 --out "$RUNNER_TEMP/k3sca"
+      - name: logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: k3sca-results
+          path: |
+            ${{ runner.temp }}/k3sca/results.tsv
+            ${{ runner.temp }}/k3sca/logs
diff --git a/docs/commands/bootstrap.md b/docs/commands/bootstrap.md
index 03dcebc..02a3475 100644
--- a/docs/commands/bootstrap.md
+++ b/docs/commands/bootstrap.md
@@ -33,6 +33,27 @@ The scripts are rendered from templates and populated with the device's decoded
 (RSA keypair, username/password, public SSH key), the domain/namespace, the device ID, a freshly
 generated K3S token, and the optional Docker secret.
 
+## The k3s CA
+
+The server scripts (`bootstrap_server_<device>.sh`) use the device certificate (`rsa_public.pem`)
+and key from the device's settings as the **root of the cluster CA** and issue the intermediate and
+leaf CAs below it. k3s v1.34.12, v1.35.9, v1.36.5, v1.37.1 and later only accept a root with the
+`keyCertSign` key usage, so the script **re-issues the root from the same key and subject** with
+`keyCertSign` and CA:TRUE (valid 20 years; the device files are not modified). The code is
+[`pkg/templates/scripts/tn-k3s-ca.sh`](https://github.com/teknoir/cli/blob/main/pkg/templates/scripts/tn-k3s-ca.sh),
+embedded in the script and usable stand-alone (`sh tn-k3s-ca.sh check|remediate`).
+
+Re-running a server script is safe:
+
+| State of the device | What the script does with the CA |
+| --- | --- |
+| k3s never started | Creates the PKI (keeps a valid one) |
+| k3s started, root is fine | Leaves it alone |
+| k3s started, root has no `keyCertSign` (bootstrapped by an older script) | Repairs it first with `k3s certificate rotate-ca` and restarts k3s, so the k3s installer that follows cannot brick the device. `TN_K3S_CA_AUTO_REMEDIATE=false` stops with advice instead; a failed repair stops the script |
+
+See [Troubleshooting](../troubleshooting.md#bootstrapping-k3s) for devices that hang or were
+bricked by a k3s upgrade. The agent script is unchanged: an agent has no CA of its own.
+
 ## Requirements
 
 A domain and namespace must be set, and you must be authenticated.
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index ffce9c6..9b2820f 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -53,6 +53,79 @@ including resolved URLs and the exact `ssh` invocation used.
     - Re-run with `--debug` to see the full `ssh` command and any `ncat`/proxy errors.
     - Verify network access to `deadend-<namespace>.<domain>:2222`.
 
+## Bootstrapping & k3s
+
+??? failure "k3s never becomes Ready: `Failed to validate connection to cluster ... CA cert validation failed ... x509: certificate signed by unknown authority`"
+    k3s v1.34.12, v1.35.9, v1.36.5, v1.37.1 and later (k3s-io/k3s#14699, a CVE fix) drop every
+    certificate without the `keyCertSign` key usage from the CA bundle. The device certificate of
+    the platform (`/etc/teknoir/rsa_public.pem`) is the **root** of the cluster CA, and the
+    certificates generated before this was fixed never had `keyCertSign`. The get.k3s.io `stable`
+    channel has been v1.36.5 since 2026-10-01, so a new device bootstrapped with an old script, or an
+    old device whose k3s was upgraded, hits this.
+
+    The bootstrap scripts generated by a `tnctl` with this fix re-issue the root from the **same key
+    and subject** with `keyCertSign` (valid 20 years); the device files in `/etc/teknoir` are never
+    changed, and everything signed below the old root stays valid. Check that your `tnctl` has it:
+    `grep -c tn_k3s_ca_setup bootstrap_server_<device>.sh` prints a number above 0.
+
+    Find out where the device is with the CA tool (`tn-k3s-ca.sh`, run as root on the device; it is
+    [`pkg/templates/scripts/tn-k3s-ca.sh`](https://github.com/teknoir/cli/blob/main/pkg/templates/scripts/tn-k3s-ca.sh)
+    in this repository and is embedded in every generated `bootstrap_server_*.sh`):
+
+    ```bash
+    sh tn-k3s-ca.sh check     # exit 0 = ok, 2 = needs rotation, 3 = needs regeneration, 4 = foreign CA
+    ```
+
+    | Situation | How to tell | What to do |
+    | --- | --- | --- |
+    | **Fresh bootstrap that hangs**: k3s was never Ready on this device | `check` says `needs-regeneration`; `/var/lib/rancher/k3s/server/token` does not exist | Run the fixed `bootstrap_server_*.sh` again, or `sh tn-k3s-ca.sh remediate`. Nothing was ever stored in the cluster, so there is nothing to rotate: the PKI is regenerated (the old files are saved as `server/tls-backup-tn-*.tar`) and k3s is restarted. `rotate-ca` cannot be used here, it needs the token a started server writes |
+    | **Bricked by an upgrade**: the device worked, then k3s was upgraded and does not start | `check` says `needs-rotation`; k3s logs the error above | `sh tn-k3s-ca.sh remediate`. k3s must be running (a k3s that loops on the error is fine, it listens). The tool stages the new CA files, runs `k3s certificate rotate-ca` against the running server, copies the files and restarts k3s. Workloads and the datastore are kept. Details below |
+    | **Still works, not upgraded yet** | `check` says `needs-rotation`; `k3s --version` shows v1.34.11, v1.35.8, v1.36.4 or v1.37.0 or older | Do it now: `sh tn-k3s-ca.sh remediate`, or run the fixed bootstrap script again (it repairs the CA before it touches k3s; `TN_K3S_CA_AUTO_REMEDIATE=false` makes it stop with advice instead) |
+    | **`foreign`** | `check` says `foreign` | The root is not the Teknoir device CA (no matching key in `server/tls/root-ca.key` or `/etc/teknoir/rsa_private.pem`). The tool does not touch it |
+
+    `remediate` runs in phases, which you can also run one at a time (`--phase`): `prepare`
+    (offline: checks, backs up `server/tls`, stages `server/.tn-ca-rotate-<time>/` with a `ROTATE_CMD`),
+    `rotate` (runs `ROTATE_CMD` against the running server), `finalize` (copies the files, only after
+    the rotation succeeded), `all` (default, plus a k3s restart). It is safe to run again: when the
+    root is fine it does nothing.
+
+    `rotate-ca` makes k3s verify the new CA bundle against the old one. An old root that has expired,
+    or that has a key usage without `keyCertSign` (the certificates the device-controller made), cannot
+    vouch for anything any more, so for those the tool verifies the new bundle itself with openssl and
+    adds `--force` to `rotate-ca` (it says so when it stages the rotation). A root without any key usage
+    (the Backstage certificates) is rotated without `--force`.
+
+    If `rotate-ca` fails, nothing was changed on disk. Use the fallback: put the last release before
+    the fix of **the same minor** in place, remediate, and upgrade again.
+
+    | Your minor | Last release without the check |
+    | --- | --- |
+    | v1.34 | v1.34.11 |
+    | v1.35 | v1.35.8 |
+    | v1.36 | v1.36.4 |
+    | v1.37 | v1.37.0 |
+
+    ```bash
+    systemctl stop k3s
+    # k3s-arm64 / k3s-armhf on ARM devices; replace the version with the row for your minor
+    curl -fL -o /usr/local/bin/k3s 'https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s'
+    chmod 755 /usr/local/bin/k3s
+    systemctl start k3s
+    sh tn-k3s-ca.sh remediate
+    ```
+
+    Then upgrade k3s as usual.
+
+    Devices with several k3s servers (embedded etcd) were not part of the tests; remediate the
+    servers one by one and read the [k3s documentation](https://docs.k3s.io/cli/certificate) for
+    `rotate-ca` first. Agent nodes need nothing: they have no CA of their own and pick up the new
+    root from the server.
+
+??? failure "Bootstrap fails with `string too long maxsize=64`"
+    The generated CA certificates carry the device ID and the domain in their common name, which is
+    limited to 64 characters. Fixed: the name is cut to 64 characters in scripts from a `tnctl` with
+    the CA fix. Regenerate the script.
+
 ## Configuration
 
 ??? question "Where is my config?"
diff --git a/pkg/templates/bootstrap_templates.go b/pkg/templates/bootstrap_templates.go
index 19d9a80..610073f 100644
--- a/pkg/templates/bootstrap_templates.go
+++ b/pkg/templates/bootstrap_templates.go
@@ -30,6 +30,15 @@ var DockerServerTemplateStr string
 //go:embed partials/*.tmpl
 var partialsFS embed.FS
 
+// TnK3sCAScript is the k3s CA library (setup, check, remediate). It is embedded in the server
+// bootstrap script as the template "tn-k3s-ca.sh" and is also usable stand-alone.
+//
+//go:embed scripts/tn-k3s-ca.sh
+var TnK3sCAScript string
+
+//go:embed scripts/*.sh
+var scriptsFS embed.FS
+
 var (
 	AgentTemplate        *template.Template
 	ServerTemplate       *template.Template
@@ -42,6 +51,7 @@ func init() {
 
 	ServerTemplate = template.Must(template.New("server").Parse(ServerTemplateStr))
 	template.Must(ServerTemplate.ParseFS(partialsFS, "partials/*.tmpl"))
+	template.Must(ServerTemplate.ParseFS(scriptsFS, "scripts/*.sh"))
 
 	DockerServerTemplate = template.Must(template.New("docker_server").Parse(DockerServerTemplateStr))
 	template.Must(DockerServerTemplate.ParseFS(partialsFS, "partials/*.tmpl"))
diff --git a/pkg/templates/k3sca_test.go b/pkg/templates/k3sca_test.go
new file mode 100644
index 0000000..2ef7e0b
--- /dev/null
+++ b/pkg/templates/k3sca_test.go
@@ -0,0 +1,589 @@
+package templates
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/pem"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+)
+
+// Offline tests of scripts/tn-k3s-ca.sh (setup, check, remediate) with the local openssl and a
+// fake k3s. The docker harness in test/k3s-ca runs the same library against real k3s releases.
+
+const libPath = "scripts/tn-k3s-ca.sh"
+
+func needTool(t *testing.T, name string) {
+	t.Helper()
+	if _, err := exec.LookPath(name); err != nil {
+		t.Skipf("%s not installed", name)
+	}
+}
+
+func TestK3sCALibraryIsPlainShell(t *testing.T) {
+	needTool(t, "sh")
+	b, err := os.ReadFile(libPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(b, []byte("{{")) {
+		t.Fatal("the library is embedded as a template: it must not contain '{{'")
+	}
+	if out, err := exec.Command("sh", "-n", libPath).CombinedOutput(); err != nil {
+		t.Fatalf("sh -n: %v\n%s", err, out)
+	}
+	if string(b) != TnK3sCAScript {
+		t.Error("embedded TnK3sCAScript differs from the file")
+	}
+	// the dangers of a file that is pasted into a bootstrap script
+	s := string(b)
+	for _, bad := range []string{"\ntrap ", "\n  trap ", "set +o noglob", "set -x"} {
+		if strings.Contains(s, bad) {
+			t.Errorf("library must not contain %q (it would change the caller's traps/options)", bad)
+		}
+	}
+}
+
+func TestServerTemplateUsesTheLibrary(t *testing.T) {
+	var buf bytes.Buffer
+	if err := ServerTemplate.Execute(&buf, TemplateData{Domain: "test.cloud", DeviceID: "dev-1", K3SToken: "tok"}); err != nil {
+		t.Fatal(err)
+	}
+	out := buf.String()
+	for _, want := range []string{"tn_k3s_ca_setup()", "TN_K3S_CA_NO_MAIN=1", "\ntn_k3s_ca_setup\n", "tn_ca_reissue_root()"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("server script lacks %q", want)
+		}
+	}
+	// the defining bug: the device certificate must not be copied verbatim to root-ca.pem
+	re := regexp.MustCompile(`cp\s+\S*rsa_public\.pem\s+\S*root-ca\.pem`)
+	if re.MatchString(out) {
+		t.Error("server script still copies rsa_public.pem to root-ca.pem")
+	}
+	if strings.Index(out, "tn_k3s_ca_setup\n") > strings.Index(out, "k3s_installer.sh") {
+		t.Error("the CA must be set up before the k3s installer runs")
+	}
+	// the agent and docker variants do not create a CA
+	for name, tpl := range map[string]string{"agent": AgentTemplateStr, "docker": DockerServerTemplateStr} {
+		if strings.Contains(tpl, "tn-k3s-ca.sh") {
+			t.Errorf("%s template unexpectedly embeds the CA library", name)
+		}
+	}
+	if _, err := exec.LookPath("sh"); err == nil {
+		f := filepath.Join(t.TempDir(), "server.sh")
+		if err := os.WriteFile(f, buf.Bytes(), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if o, err := exec.Command("sh", "-n", f).CombinedOutput(); err != nil {
+			t.Errorf("rendered server script: sh -n: %v\n%s", err, o)
+		}
+	}
+}
+
+// ---------------------------------------------------------------- the PKI
+
+type pki struct {
+	t    *testing.T
+	dir  string // work dir
+	cfg  string // CONFIG_PATH
+	data string // DATA_DIR
+}
+
+func newPKI(t *testing.T) *pki {
+	t.Helper()
+	needTool(t, "sh")
+	needTool(t, "openssl")
+	p := &pki{t: t, dir: t.TempDir()}
+	p.cfg = filepath.Join(p.dir, "etc")
+	p.data = filepath.Join(p.dir, "data")
+	for _, d := range []string{p.cfg, p.data} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return p
+}
+
+// legacyCert writes the pair Backstage generates (openssl req -x509, no keyUsage).
+func (p *pki) legacyCert() { p.legacyCertArgs() }
+
+// legacyCertArgs adds openssl req arguments, e.g. -addext keyUsage=... for the device-controller kind.
+func (p *pki) legacyCertArgs(extra ...string) {
+	p.t.Helper()
+	args := []string{"req", "-x509", "-nodes", "-newkey", "rsa:2048",
+		"-keyout", filepath.Join(p.cfg, "rsa_private.pem"), "-out", filepath.Join(p.cfg, "rsa_public.pem"),
+		"-days", "365", "-subj", "/C=US/ST=Texas/L=SHouston/O=Teknoir LLC/CN=teknoir.ai", "-sha256", "-batch"}
+	cmd := exec.Command("openssl", append(args, extra...)...)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		p.t.Fatalf("openssl req: %v\n%s", err, out)
+	}
+}
+
+// sh runs script with the bootstrap script shell options and the library sourced.
+func (p *pki) sh(script string, env ...string) (string, error) {
+	p.t.Helper()
+	full := "set -e; set -o noglob; umask 027; " +
+		"info() { echo '[INFO] ' \"$@\"; }; warn() { echo '[WARN] ' \"$@\" >&2; }; fatal() { echo '[ERROR] ' \"$@\" >&2; exit 1; }; " +
+		". " + libPath + "; " + script
+	cmd := exec.Command("sh", "-c", full)
+	cmd.Env = append(os.Environ(), "CONFIG_PATH="+p.cfg, "DATA_DIR="+p.data, "PRODUCT=k3s", "_DEVICE_ID=dev1", "_DOMAIN=test.local")
+	cmd.Env = append(cmd.Env, env...)
+	out, err := cmd.CombinedOutput()
+	if bytes.Contains(out, []byte("PRIVATE KEY")) {
+		p.t.Errorf("a private key was printed:\n%s", out)
+	}
+	return string(out), err
+}
+
+func (p *pki) mustSh(script string, env ...string) string {
+	p.t.Helper()
+	out, err := p.sh(script, env...)
+	if err != nil {
+		p.t.Fatalf("%s: %v\n%s", script, err, out)
+	}
+	return out
+}
+
+// check runs `check` and returns its exit code
+func (p *pki) check() (int, string) {
+	p.t.Helper()
+	out, err := p.sh("tn_ca_check")
+	if err == nil {
+		return 0, out
+	}
+	if ee, ok := err.(*exec.ExitError); ok {
+		return ee.ExitCode(), out
+	}
+	p.t.Fatal(err)
+	return -1, ""
+}
+
+func (p *pki) tls(name string) string { return filepath.Join(p.data, "server", "tls", name) }
+
+func readCerts(t *testing.T, path string) []*x509.Certificate {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var certs []*x509.Certificate
+	for {
+		var blk *pem.Block
+		blk, b = pem.Decode(b)
+		if blk == nil {
+			break
+		}
+		c, err := x509.ParseCertificate(blk.Bytes)
+		if err != nil {
+			t.Fatalf("%s: %v", path, err)
+		}
+		certs = append(certs, c)
+	}
+	if len(certs) == 0 {
+		t.Fatalf("%s: no certificates", path)
+	}
+	return certs
+}
+
+func sum(t *testing.T, path string) string {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := sha256.Sum256(b)
+	return hex.EncodeToString(h[:])
+}
+
+// k3sPool builds the trust pool like k3s >= v1.36.5: certificates without keyCertSign are
+// dropped from a multi-certificate bundle, roots are the self-issued ones.
+func k3sPool(certs []*x509.Certificate) *x509.CertPool {
+	pool := x509.NewCertPool()
+	for _, c := range certs {
+		if c.KeyUsage&x509.KeyUsageCertSign != 0 && (len(c.AuthorityKeyId) == 0 || bytes.Equal(c.AuthorityKeyId, c.SubjectKeyId)) {
+			pool.AddCert(c)
+		}
+	}
+	return pool
+}
+
+func (p *pki) assertGoodPKI(orig []byte) {
+	t := p.t
+	t.Helper()
+	oc := readCerts(t, filepath.Join(p.cfg, "rsa_public.pem"))[0]
+	root := readCerts(t, p.tls("root-ca.pem"))[0]
+	if !root.IsCA || root.KeyUsage&x509.KeyUsageCertSign == 0 || root.KeyUsage&x509.KeyUsageCRLSign == 0 {
+		t.Errorf("root: IsCA=%v KeyUsage=%b", root.IsCA, root.KeyUsage)
+	}
+	if len(root.ExtKeyUsage) != 0 {
+		t.Error("root has extendedKeyUsage")
+	}
+	if !bytes.Equal(root.RawSubject, oc.RawSubject) || !bytes.Equal(root.RawIssuer, root.RawSubject) {
+		t.Error("root subject differs from the device certificate, or is not self-issued")
+	}
+	if len(oc.SubjectKeyId) > 0 && !bytes.Equal(root.SubjectKeyId, oc.SubjectKeyId) {
+		t.Error("root SKI differs from the device certificate")
+	}
+	if len(root.AuthorityKeyId) > 0 && !bytes.Equal(root.AuthorityKeyId, root.SubjectKeyId) {
+		t.Error("root AKI != SKI: k3s would treat it as an intermediate")
+	}
+	if !root.PublicKey.(interface{ Equal(crypto.PublicKey) bool }).Equal(oc.PublicKey) {
+		t.Error("root public key differs from the device certificate")
+	}
+	if d := time.Until(root.NotAfter); d < 7000*24*time.Hour || d > 7400*24*time.Hour {
+		t.Errorf("root valid for %v, want about 7300 days", d)
+	}
+	seen := map[string]bool{}
+	for _, e := range root.Extensions {
+		if seen[e.Id.String()] {
+			t.Errorf("duplicate extension %s", e.Id)
+		}
+		seen[e.Id.String()] = true
+	}
+	for _, b := range []string{"server-ca.crt", "client-ca.crt", "request-header-ca.crt", "etcd/peer-ca.crt", "etcd/server-ca.crt", "intermediate-ca.crt"} {
+		certs := readCerts(t, p.tls(b))
+		for i, c := range certs {
+			if c.KeyUsage&x509.KeyUsageCertSign == 0 {
+				t.Errorf("%s cert %d (%s) has no keyCertSign: k3s would prune it", b, i, c.Subject.CommonName)
+			}
+		}
+		inter := x509.NewCertPool()
+		for _, c := range certs[1 : len(certs)-1] {
+			inter.AddCert(c)
+		}
+		if _, err := certs[0].Verify(x509.VerifyOptions{Roots: k3sPool(certs), Intermediates: inter, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}}); err != nil {
+			t.Errorf("%s: %v", b, err)
+		}
+		if last := certs[len(certs)-1]; !bytes.Equal(last.Raw, root.Raw) && b != "root-ca.crt" {
+			t.Errorf("%s does not end in the root", b)
+		}
+	}
+	if got := sum(t, filepath.Join(p.cfg, "rsa_public.pem")); got != hashOf(orig) {
+		t.Error("rsa_public.pem was modified")
+	}
+}
+
+func hashOf(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
+
+func TestSetupCreatesAProperRoot(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	orig, _ := os.ReadFile(filepath.Join(p.cfg, "rsa_public.pem"))
+	out := p.mustSh("tn_k3s_ca_setup")
+	if !strings.Contains(out, "keyCertSign") {
+		t.Errorf("no message about the re-issued root:\n%s", out)
+	}
+	p.assertGoodPKI(orig)
+	if rc, o := p.check(); rc != 0 {
+		t.Errorf("check rc=%d: %s", rc, o)
+	}
+
+	// a second run while k3s never started keeps the PKI
+	before := sum(t, p.tls("server-ca.crt"))
+	p.mustSh("tn_k3s_ca_setup")
+	if sum(t, p.tls("server-ca.crt")) != before {
+		t.Error("second setup regenerated a valid PKI")
+	}
+
+	// a run on an initialised data dir never touches it
+	if err := os.WriteFile(filepath.Join(p.data, "server", "token"), []byte("K10x::server:y"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	p.mustSh("tn_k3s_ca_setup")
+	if sum(t, p.tls("server-ca.crt")) != before {
+		t.Error("setup changed the PKI of an initialised data dir")
+	}
+}
+
+func TestSetupLongDeviceName(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	p.mustSh("tn_k3s_ca_setup", "_DEVICE_ID=a-device-with-a-really-long-name-for-an-edge-computer", "_DOMAIN=customer-teamspace.teknoir.cloud")
+	for _, c := range readCerts(t, p.tls("request-header-ca.crt"))[:1] {
+		if n := len(c.Subject.CommonName); n == 0 || n > 64 {
+			t.Errorf("CN %q has %d characters", c.Subject.CommonName, n)
+		}
+	}
+}
+
+// the old, broken layout: the device certificate itself as the root
+func (p *pki) legacyPKI(initialised bool) {
+	p.t.Helper()
+	legacy, err := filepath.Abs("../../test/k3s-ca/legacy-ca.sh")
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	tls := filepath.Join(p.data, "server", "tls")
+	if err := os.MkdirAll(tls, 0o750); err != nil {
+		p.t.Fatal(err)
+	}
+	cmd := exec.Command("sh", "-c", "set -e; set -o noglob; umask 027; . "+legacy+"; tn_legacy_ca "+tls+" "+p.cfg+"/rsa_public.pem "+p.cfg+"/rsa_private.pem dev1.test.local")
+	cmd.Env = append(os.Environ(), "PRODUCT=k3s")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		p.t.Fatalf("legacy PKI: %v\n%s", err, out)
+	}
+	if initialised {
+		if err := os.WriteFile(filepath.Join(p.data, "server", "token"), []byte("K10x::server:y"), 0o600); err != nil {
+			p.t.Fatal(err)
+		}
+	}
+}
+
+func fakeK3s(t *testing.T, dir string, ok bool) (bin, log string) {
+	t.Helper()
+	log = filepath.Join(dir, "k3s-calls")
+	bin = filepath.Join(dir, "fake-k3s")
+	rc := "0"
+	if !ok {
+		rc = "1"
+	}
+	script := "#!/bin/sh\necho \"SSL_CERT_FILE=$SSL_CERT_FILE $*\" >> '" + log + "'\nexit " + rc + "\n"
+	if err := os.WriteFile(bin, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	return bin, log
+}
+
+func TestRemediateInitialisedLegacyDevice(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	orig, _ := os.ReadFile(filepath.Join(p.cfg, "rsa_public.pem"))
+	p.legacyPKI(true)
+	if rc, o := p.check(); rc != 2 || !strings.Contains(o, "needs-rotation") {
+		t.Fatalf("check on a legacy initialised device: rc=%d %s", rc, o)
+	}
+	oldRoot := sum(t, p.tls("root-ca.pem"))
+	if oldRoot != hashOf(orig) {
+		t.Fatal("legacy fixture does not copy the device certificate")
+	}
+
+	// prepare stages the rotation and changes nothing on disk
+	before := sum(t, p.tls("server-ca.crt"))
+	p.mustSh("tn_ca_openssl; tn_ca_remediate prepare")
+	if sum(t, p.tls("server-ca.crt")) != before || sum(t, p.tls("root-ca.pem")) != oldRoot {
+		t.Error("prepare modified server/tls")
+	}
+	stages, _ := filepath.Glob(filepath.Join(p.data, "server", ".tn-ca-rotate-*"))
+	if len(stages) != 1 {
+		t.Fatalf("staging dirs: %v", stages)
+	}
+	rotate, err := os.ReadFile(filepath.Join(stages[0], "ROTATE_CMD"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(rotate), "certificate rotate-ca") || strings.Contains(string(rotate), "--force") || strings.Contains(string(rotate), "PRIVATE") {
+		t.Errorf("ROTATE_CMD: %s", rotate)
+	}
+	if fi, _ := os.Stat(stages[0]); fi.Mode().Perm() != 0o700 {
+		t.Errorf("staging dir mode %v", fi.Mode().Perm())
+	}
+	if _, err := filepath.Glob(filepath.Join(p.data, "server", "tls-backup-tn-*.tar")); err != nil {
+		t.Fatal(err)
+	}
+	if m, _ := filepath.Glob(filepath.Join(p.data, "server", "tls-backup-tn-*.tar")); len(m) != 1 {
+		t.Errorf("backups: %v", m)
+	}
+
+	// finalize before the rotation happened must refuse
+	if out, err := p.sh("tn_ca_openssl; tn_ca_remediate finalize"); err == nil {
+		t.Errorf("finalize without a completed rotation succeeded:\n%s", out)
+	}
+	if sum(t, p.tls("root-ca.pem")) != oldRoot {
+		t.Error("finalize without ROTATED changed the root")
+	}
+
+	// a failing rotate-ca leaves everything as it was and says what to do
+	badBin, _ := fakeK3s(t, t.TempDir(), false)
+	if out, err := p.sh("tn_ca_openssl; tn_ca_remediate rotate", "K3S_BIN="+badBin); err == nil || !strings.Contains(out, "v1.36.4") {
+		t.Errorf("failed rotate: err=%v\n%s", err, out)
+	}
+	if sum(t, p.tls("root-ca.pem")) != oldRoot {
+		t.Error("failed rotate changed the root")
+	}
+
+	// the full run with a fake k3s that "succeeds"
+	bin, calls := fakeK3s(t, t.TempDir(), true)
+	restarted := filepath.Join(p.dir, "restarted")
+	p.mustSh("tn_ca_remediate all", "K3S_BIN="+bin, "TN_K3S_RESTART_CMD=touch "+restarted)
+	if _, err := os.Stat(restarted); err != nil {
+		t.Error("k3s was not restarted")
+	}
+	c, _ := os.ReadFile(calls)
+	if !strings.Contains(string(c), "certificate rotate-ca --data-dir "+p.data+" --path ") || !strings.Contains(string(c), "SSL_CERT_FILE=") {
+		t.Errorf("k3s was called with: %s", c)
+	}
+	p.assertGoodPKI(orig)
+	if rc, o := p.check(); rc != 0 {
+		t.Errorf("check after remediate rc=%d %s", rc, o)
+	}
+	if m, _ := filepath.Glob(filepath.Join(p.data, "server", ".tn-ca-rotate-*")); len(m) != 0 {
+		t.Errorf("staging left behind: %v", m)
+	}
+
+	// idempotent: a second remediate and a setup change nothing
+	after := sum(t, p.tls("server-ca.crt")) + sum(t, p.tls("root-ca.pem")) + sum(t, p.tls("intermediate-ca.crt"))
+	p.mustSh("tn_ca_remediate all", "K3S_BIN="+bin, "TN_K3S_RESTART_CMD=false")
+	p.mustSh("tn_k3s_ca_setup", "K3S_BIN="+bin)
+	if got := sum(t, p.tls("server-ca.crt")) + sum(t, p.tls("root-ca.pem")) + sum(t, p.tls("intermediate-ca.crt")); got != after {
+		t.Error("a second remediate/setup changed the PKI")
+	}
+}
+
+// A root with a keyUsage that lacks keyCertSign (the device-controller kind) cannot vouch for the
+// chain in k3s's own check of the new CA bundle, so rotate-ca needs --force there. Only there.
+func TestRotateCmdForcesOnlyWhenTheOldRootCannotVouch(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCertArgs("-addext", "keyUsage=digitalSignature,keyEncipherment")
+	p.legacyPKI(true)
+	out := p.mustSh("tn_ca_openssl; tn_ca_remediate prepare")
+	if !strings.Contains(out, "--force") {
+		t.Errorf("no word about --force:\n%s", out)
+	}
+	stages, _ := filepath.Glob(filepath.Join(p.data, "server", ".tn-ca-rotate-*"))
+	if len(stages) != 1 {
+		t.Fatalf("staging dirs: %v", stages)
+	}
+	rotate, _ := os.ReadFile(filepath.Join(stages[0], "ROTATE_CMD"))
+	if !strings.Contains(string(rotate), "--path '"+stages[0]+"/server' --force && touch") {
+		t.Errorf("ROTATE_CMD: %s", rotate)
+	}
+
+	// no keyUsage at all (Backstage kind): k3s can verify, no --force
+	q := newPKI(t)
+	q.legacyCert()
+	q.legacyPKI(true)
+	q.mustSh("tn_ca_openssl; tn_ca_remediate prepare")
+	stages, _ = filepath.Glob(filepath.Join(q.data, "server", ".tn-ca-rotate-*"))
+	rotate, _ = os.ReadFile(filepath.Join(stages[0], "ROTATE_CMD"))
+	if strings.Contains(string(rotate), "--force") {
+		t.Errorf("unexpected --force: %s", rotate)
+	}
+}
+
+func TestSetupRepairsAnInitialisedLegacyDevice(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	orig, _ := os.ReadFile(filepath.Join(p.cfg, "rsa_public.pem"))
+	p.legacyPKI(true)
+	bin, calls := fakeK3s(t, t.TempDir(), true)
+
+	// opt out: stops before anything is touched
+	before := sum(t, p.tls("root-ca.pem"))
+	if out, err := p.sh("tn_k3s_ca_setup", "TN_K3S_CA_AUTO_REMEDIATE=false", "K3S_BIN="+bin); err == nil || !strings.Contains(out, "remediate") {
+		t.Errorf("auto-remediate=false: err=%v\n%s", err, out)
+	}
+	if sum(t, p.tls("root-ca.pem")) != before {
+		t.Error("changed despite TN_K3S_CA_AUTO_REMEDIATE=false")
+	}
+
+	// default: repaired before the installer would run
+	p.mustSh("tn_k3s_ca_setup", "K3S_BIN="+bin, "TN_K3S_RESTART_CMD=true")
+	if c, _ := os.ReadFile(calls); !strings.Contains(string(c), "rotate-ca") {
+		t.Errorf("setup did not rotate: %s", c)
+	}
+	p.assertGoodPKI(orig)
+
+	// a failing rotation stops the bootstrap (no installer run that would brick the device)
+	p2 := newPKI(t)
+	p2.legacyCert()
+	p2.legacyPKI(true)
+	badBin, _ := fakeK3s(t, t.TempDir(), false)
+	if _, err := p2.sh("tn_k3s_ca_setup", "K3S_BIN="+badBin, "TN_K3S_RESTART_CMD=true"); err == nil {
+		t.Error("setup continued after a failed rotation")
+	}
+}
+
+func TestRemediateHungFreshBootstrap(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	orig, _ := os.ReadFile(filepath.Join(p.cfg, "rsa_public.pem"))
+	p.legacyPKI(false) // old script ran, post-fix k3s never finished its start: no server/token
+	if rc, o := p.check(); rc != 3 || !strings.Contains(o, "needs-regeneration") {
+		t.Fatalf("check: rc=%d %s", rc, o)
+	}
+	// no k3s is needed: there is nothing to rotate
+	out := p.mustSh("tn_ca_remediate prepare", "K3S_BIN=/nonexistent/k3s")
+	if !strings.Contains(out, "Nothing to rotate") {
+		t.Errorf("message:\n%s", out)
+	}
+	if m, _ := filepath.Glob(filepath.Join(p.data, "server", ".tn-ca-rotate-*")); len(m) != 0 {
+		t.Errorf("unexpected staging %v", m)
+	}
+	p.assertGoodPKI(orig)
+	if rc, o := p.check(); rc != 0 {
+		t.Errorf("check after: rc=%d %s", rc, o)
+	}
+	if m, _ := filepath.Glob(filepath.Join(p.data, "server", "tls-backup-tn-*.tar")); len(m) != 1 {
+		t.Errorf("the old tls dir was not backed up: %v", m)
+	}
+	// `remediate` (all phases) on such a device regenerates and restarts, without calling k3s
+	p3 := newPKI(t)
+	p3.legacyCert()
+	orig3, _ := os.ReadFile(filepath.Join(p3.cfg, "rsa_public.pem"))
+	p3.legacyPKI(false)
+	bin, calls := fakeK3s(t, t.TempDir(), true)
+	restarted := filepath.Join(p3.dir, "restarted")
+	p3.mustSh("tn_ca_remediate all", "K3S_BIN="+bin, "TN_K3S_RESTART_CMD=touch "+restarted)
+	if _, err := os.Stat(restarted); err != nil {
+		t.Error("k3s was not restarted")
+	}
+	if _, err := os.Stat(calls); err == nil {
+		t.Error("k3s was called although there is nothing to rotate")
+	}
+	p3.assertGoodPKI(orig3)
+	// re-running the bootstrap script on such a device is the other way to the same result
+	p2 := newPKI(t)
+	p2.legacyCert()
+	orig2, _ := os.ReadFile(filepath.Join(p2.cfg, "rsa_public.pem"))
+	p2.legacyPKI(false)
+	p2.mustSh("tn_k3s_ca_setup")
+	p2.assertGoodPKI(orig2)
+}
+
+func TestCheckStates(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	// an agent / fresh machine: nothing to check
+	if rc, o := p.check(); rc != 0 || !strings.Contains(o, "not-a-server") {
+		t.Errorf("no tls dir: rc=%d %s", rc, o)
+	}
+	// a legacy PKI whose key we do not hold (device files of another device)
+	p.legacyPKI(true)
+	if err := os.Remove(p.tls("root-ca.key")); err != nil {
+		t.Fatal(err)
+	}
+	other := newPKI(t)
+	other.legacyCert()
+	p.cfg = other.cfg
+	if rc, o := p.check(); rc != 4 || !strings.Contains(o, "foreign") {
+		t.Errorf("foreign CA: rc=%d %s", rc, o)
+	}
+	if out, err := p.sh("tn_ca_openssl; tn_ca_remediate prepare"); err == nil {
+		t.Errorf("prepare on a foreign CA succeeded:\n%s", out)
+	}
+}
+
+func TestProgramMode(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	p.legacyPKI(true)
+	cmd := exec.Command("sh", libPath, "check", "--data-dir", p.data, "--config-dir", p.cfg)
+	out, err := cmd.CombinedOutput()
+	ee, ok := err.(*exec.ExitError)
+	if !ok || ee.ExitCode() != 2 || !strings.Contains(string(out), "needs-rotation") {
+		t.Errorf("sh tn-k3s-ca.sh check: %v\n%s", err, out)
+	}
+	// sourcing with the caller's own arguments must not start the program
+	cmd = exec.Command("sh", "-c", ". "+libPath+"; echo sourced")
+	if out, err := cmd.CombinedOutput(); err != nil || strings.TrimSpace(string(out)) != "sourced" {
+		t.Errorf("sourcing printed: %v %q", err, out)
+	}
+}
diff --git a/pkg/templates/scripts/tn-k3s-ca.sh b/pkg/templates/scripts/tn-k3s-ca.sh
new file mode 100644
index 0000000..2313223
--- /dev/null
+++ b/pkg/templates/scripts/tn-k3s-ca.sh
@@ -0,0 +1,628 @@
+#!/bin/sh
+# tn-k3s-ca.sh - the custom k3s CA of a Teknoir device: setup, check, remediate.
+#
+# Background. A Teknoir device uses its own certificate (Device CR settings,
+# /etc/teknoir/rsa_public.pem + rsa_private.pem) as the ROOT of the k3s cluster
+# CA and issues the intermediate and the five leaf CAs below it. k3s v1.34.12,
+# v1.35.9, v1.36.5, v1.37.1 and later (k3s-io/k3s#14699, "Improve CA hash
+# validation") drop every certificate without the keyCertSign key usage from the
+# CA bundle before they build the trust pool. The device certificates of the
+# platform never had keyCertSign, so such a k3s refuses to start
+# ("CA cert validation failed ... x509: certificate signed by unknown authority").
+#
+# The fix is to give the root the missing key usage. The root is re-issued from
+# the SAME key and subject (and subject key identifier): a new self-signed root
+# with CA:TRUE and keyCertSign, valid 20 years. Everything signed below the old
+# root stays valid (same key, same subject), and the device files are never
+# modified.
+#
+# Three ways to use this file:
+#
+#   . tn-k3s-ca.sh; tn_k3s_ca_setup     bootstrap scripts (sourced): creates the
+#                                       PKI of a new device, leaves an
+#                                       initialised one alone, repairs an old one
+#   sh tn-k3s-ca.sh check               is the root of this device acceptable to k3s?
+#   sh tn-k3s-ca.sh remediate           repair a device bootstrapped with the old root
+#
+# POSIX sh. It runs under `set -e` and `set -o noglob` (as the bootstrap scripts
+# do) and does not change shell options, traps or the working directory of the
+# caller. Sourcing it defines functions only.
+#
+# Environment (all optional when run as a program):
+#   CONFIG_PATH    directory with rsa_public.pem and rsa_private.pem (/etc/teknoir)
+#   DATA_DIR       k3s data dir (/var/lib/rancher/k3s)
+#   PRODUCT        k3s
+#   _DEVICE_ID, _DOMAIN   used in the CN of the generated CAs (taken from the
+#                  existing CAs when not set)
+#   K3S_BIN        k3s command used by `rotate-ca` (k3s)
+#   TN_K3S_RESTART_CMD    restarts k3s after a remediation (systemctl restart k3s)
+#   TN_K3S_CA_AUTO_REMEDIATE  true (default) / false: a re-run of a bootstrap script
+#                  repairs an initialised data dir itself; false stops with advice
+#
+# check exit codes:
+#   0  ok (the root is acceptable to k3s, or this is not a server, or k3s made its own CA)
+#   2  needs-rotation: initialised data dir, root unusable => `remediate`
+#   3  needs-regeneration: data dir never initialised, PKI unusable => `remediate`
+#      (or re-run the bootstrap script)
+#   4  foreign: the root is unusable but we do not hold its key (not a Teknoir CA)
+#   1  error
+
+TN_K3S_CA_LIB_VERSION=1
+export TN_K3S_CA_LIB_VERSION
+
+# ----------------------------------------------------------------- messages
+# info/warn/fatal come from the bootstrap script header. Fallbacks for a bare run.
+command -v info >/dev/null 2>&1 || info() { echo '[INFO] ' "$@"; }
+command -v warn >/dev/null 2>&1 || warn() { echo '[WARN] ' "$@" >&2; }
+command -v fatal >/dev/null 2>&1 || fatal() { echo '[ERROR] ' "$@" >&2; exit 1; }
+
+# ----------------------------------------------------------------- small helpers
+
+# Select the openssl binary (3.x if installed side by side, as on some distros).
+tn_ca_openssl() {
+  if command -v openssl-3 >/dev/null 2>&1; then
+    OPENSSL=openssl-3
+  elif command -v openssl >/dev/null 2>&1; then
+    OPENSSL=openssl
+  else
+    warn "openssl not found"
+    return 1
+  fi
+  if ! "$OPENSSL" ecparam -name prime256v1 -genkey -noout -out /dev/null >/dev/null 2>&1; then
+    warn "openssl missing Elliptic Curve (ecparam) support"
+    return 1
+  fi
+  return 0
+}
+
+tn_ca_ts() { date +%Y%m%dT%H%M%S; }
+
+# tn_ca_split PEMFILE DIR: write every certificate of PEMFILE to DIR/c<N>.pem, N from 0.
+# Echoes the number of certificates.
+tn_ca_split() {
+  mkdir -p "$2" || return 1
+  awk -v d="$2" '
+    /-----BEGIN CERTIFICATE-----/ { f = sprintf("%s/c%d.pem", d, n); n++ }
+    f { print > f }
+    /-----END CERTIFICATE-----/ { if (f != "") close(f); f = "" }
+    END { print n + 0 }' "$1"
+}
+
+# tn_ca_fp CERT: sha256 fingerprint
+tn_ca_fp() { "$OPENSSL" x509 -in "$1" -noout -fingerprint -sha256 | cut -d= -f2; }
+
+# tn_ca_pubhash_cert CERT / tn_ca_pubhash_key KEY: sha256 of the public key (SPKI)
+tn_ca_pubhash_cert() { "$OPENSSL" x509 -in "$1" -noout -pubkey 2>/dev/null | sha256sum | cut -d' ' -f1; }
+tn_ca_pubhash_key() { "$OPENSSL" pkey -in "$1" -pubout 2>/dev/null | sha256sum | cut -d' ' -f1; }
+
+# tn_ca_ski CERT: subject key identifier as printed by openssl, or empty
+tn_ca_ski() {
+  "$OPENSSL" x509 -in "$1" -noout -text 2>/dev/null |
+    awk '/X509v3 Subject Key Identifier/ { getline; gsub(/[ \t]/, ""); print; exit }'
+}
+
+# tn_ca_has_certsign CERT
+tn_ca_has_certsign() { "$OPENSSL" x509 -in "$1" -noout -text 2>/dev/null | grep -q 'Certificate Sign'; }
+
+# tn_ca_dir_ok DIR: a data dir whose server/token exists was started by k3s once
+tn_ca_initialised() { [ -s "$1/server/token" ]; }
+
+# tn_ca_lastcert BUNDLE OUTFILE: write the last (root) certificate of BUNDLE
+tn_ca_lastcert() {
+  _tn_w=$(mktemp -d) || return 1
+  _tn_n=$(tn_ca_split "$1" "$_tn_w")
+  if [ "${_tn_n:-0}" -lt 1 ]; then rm -rf "$_tn_w"; return 1; fi
+  cp "$_tn_w/c$((_tn_n - 1)).pem" "$2"
+  rm -rf "$_tn_w"
+}
+
+# Bundles k3s reads (leaf first, root last), relative to server/tls.
+TN_CA_BUNDLES="server-ca.crt client-ca.crt request-header-ca.crt etcd/peer-ca.crt etcd/server-ca.crt intermediate-ca.crt root-ca.crt"
+
+# ----------------------------------------------------------------- the root certificate
+
+# tn_ca_reissue_root SRC_CERT KEY OUT_CERT
+# New self-signed root from the SAME key and subject as SRC_CERT (and the same subject key
+# identifier), with CA:TRUE and keyUsage keyCertSign, valid 7300 days. The extensions of
+# SRC_CERT are cleared first (no duplicates, no extendedKeyUsage).
+tn_ca_reissue_root() {
+  _tn_rw=$(mktemp -d) || return 1
+  _tn_rski=$(tn_ca_ski "$1")
+  [ -n "$_tn_rski" ] || _tn_rski='hash'
+  cat > "$_tn_rw/root.cnf" <<EOF
+[v3_root]
+subjectKeyIdentifier = $_tn_rski
+authorityKeyIdentifier = keyid:always
+basicConstraints = critical, CA:true
+keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign, cRLSign
+EOF
+  _tn_serial=$("$OPENSSL" rand -hex 16) || { rm -rf "$_tn_rw"; return 1; }
+  "$OPENSSL" x509 -in "$1" -signkey "$2" -clrext -extfile "$_tn_rw/root.cnf" -extensions v3_root \
+    -set_serial "0x$_tn_serial" -days 7300 -sha256 -out "$3" >/dev/null 2>&1
+  _tn_rc=$?
+  rm -rf "$_tn_rw"
+  if [ "$_tn_rc" -ne 0 ]; then warn "cannot re-issue the root certificate from $1"; return 1; fi
+  tn_ca_has_certsign "$3" || { warn "re-issued root has no keyCertSign"; return 1; }
+}
+
+# ----------------------------------------------------------------- PKI generation
+
+# tn_ca_generate_pki TLS_DIR ROOT_CERT ROOT_KEY SUFFIX
+# TLS_DIR must exist and be empty. Creates root-ca.{pem,key,crt}, intermediate-ca.*, the five
+# leaf CAs and service.key in it exactly as the old bootstrap scripts did, below ROOT_CERT.
+# Runs in a subshell: the caller's directory and traps are not touched.
+tn_ca_generate_pki() {
+  (
+    set -e
+    tls=$1 root=$2 rkey=$3 suffix=$4
+    product=${PRODUCT:-k3s}
+    cd "$tls"
+    mkdir -p etcd .ca/certs
+    cp "$root" root-ca.pem
+    cp "$rkey" root-ca.key
+    : > .ca/index
+    "$OPENSSL" rand -hex 8 > .ca/serial
+    cat > .ca/config <<'EOF'
+[ca]
+default_ca = ca_default
+[ca_default]
+dir = ./.ca
+database = $dir/index
+serial = $dir/serial
+new_certs_dir = $dir/certs
+default_md = sha256
+policy = policy_anything
+[policy_anything]
+commonName = supplied
+[req]
+distinguished_name = req_distinguished_name
+[req_distinguished_name]
+[v3_ca]
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+basicConstraints = critical, CA:true
+keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign
+EOF
+    if "$OPENSSL" version | grep -qF 'OpenSSL 3'; then GENRSA_FLAGS=-traditional; else GENRSA_FLAGS=; fi
+
+    # a CN is at most 64 characters (long device names used to break the bootstrap here)
+    cn() { printf '%s' "$1" | cut -c1-64; }
+    # quiet openssl, but show what it said when it fails
+    quiet() { "$@" > .ca/log 2>&1 || { cat .ca/log >&2; return 1; }; }
+
+    info "Generating Kubernetes service account issuer RSA key"
+    # shellcheck disable=SC2086
+    quiet "$OPENSSL" genrsa $GENRSA_FLAGS -out service.key 2048
+
+    cat root-ca.pem > root-ca.crt
+
+    info "Generating intermediate certificate authority RSA key and certificate"
+    # shellcheck disable=SC2086
+    quiet "$OPENSSL" genrsa $GENRSA_FLAGS -out intermediate-ca.key 4096
+    "$OPENSSL" req -new -nodes -subj "/CN=$(cn "${product}-intermediate-ca@${suffix}")" \
+      -key intermediate-ca.key 2>/dev/null |
+    quiet "$OPENSSL" ca -batch -notext -days 3700 -in /dev/stdin -out intermediate-ca.pem \
+      -keyfile root-ca.key -cert root-ca.pem -config .ca/config -extensions v3_ca
+    cat intermediate-ca.pem root-ca.pem > intermediate-ca.crt
+
+    # a new leaf CA for every control-plane and etcd component
+    for TYPE in client server request-header etcd/peer etcd/server; do
+      name="${product}-$(echo "$TYPE" | tr / -)-ca"
+      info "Generating ${name} leaf certificate authority EC key and certificate"
+      quiet "$OPENSSL" ecparam -name prime256v1 -genkey -noout -out "${TYPE}-ca.key"
+      "$OPENSSL" req -new -nodes -subj "/CN=$(cn "${name}@${suffix}")" -key "${TYPE}-ca.key" 2>/dev/null |
+      quiet "$OPENSSL" ca -batch -notext -days 3700 -in /dev/stdin -out "${TYPE}-ca.pem" \
+        -keyfile intermediate-ca.key -cert intermediate-ca.pem -config .ca/config -extensions v3_ca
+      cat "${TYPE}-ca.pem" intermediate-ca.pem root-ca.pem > "${TYPE}-ca.crt"
+    done
+    rm -rf .ca
+  )
+}
+
+# ----------------------------------------------------------------- state of a data dir
+
+# tn_ca_find_key DATA_DIR ROOT_CERT -> sets TN_CA_KEY to a private key file whose public
+# key matches ROOT_CERT (server/tls/root-ca.key first, then the device key); returns 1 if none.
+tn_ca_find_key() {
+  TN_CA_KEY=; TN_CA_UNREADABLE=
+  _tn_want=$(tn_ca_pubhash_cert "$2")
+  [ -n "$_tn_want" ] || return 1
+  for _tn_k in "$1/server/tls/root-ca.key" "${CONFIG_PATH:-/etc/teknoir}/rsa_private.pem"; do
+    [ -f "$_tn_k" ] || continue
+    [ -r "$_tn_k" ] || { TN_CA_UNREADABLE=$_tn_k; continue; }
+    if [ "$(tn_ca_pubhash_key "$_tn_k")" = "$_tn_want" ]; then TN_CA_KEY=$_tn_k; return 0; fi
+  done
+  return 1
+}
+
+# tn_ca_state DATA_DIR
+# Sets TN_CA_STATE and TN_CA_MSG; returns the `check` exit code.
+#   not-a-server        no server/tls/server-ca.crt (an agent node, or nothing installed yet)
+#   ok                  the root has keyCertSign and is valid for more than 90 days
+#   needs-rotation      initialised, root unusable, we hold the key
+#   needs-regeneration  never initialised, PKI unusable, we hold the key
+#   foreign             root unusable and we do not hold its key
+tn_ca_state() {
+  TN_CA_STATE=; TN_CA_MSG=
+  _tn_tls=$1/server/tls
+  if [ ! -f "$_tn_tls/server-ca.crt" ]; then
+    TN_CA_STATE=not-a-server; TN_CA_MSG="no $_tn_tls/server-ca.crt: nothing to check"; return 0
+  fi
+  _tn_sw=$(mktemp -d) || return 1
+  if ! tn_ca_lastcert "$_tn_tls/server-ca.crt" "$_tn_sw/root.pem"; then
+    rm -rf "$_tn_sw"; TN_CA_STATE=error; TN_CA_MSG="cannot read the root certificate from $_tn_tls/server-ca.crt"; return 1
+  fi
+  _tn_ncert=$(tn_ca_split "$_tn_tls/server-ca.crt" "$_tn_sw/b")
+  _tn_why=
+  if [ "$_tn_ncert" -gt 1 ]; then
+    tn_ca_has_certsign "$_tn_sw/root.pem" || _tn_why="the root certificate has no keyCertSign"
+  fi
+  if [ -z "$_tn_why" ] && ! "$OPENSSL" x509 -in "$_tn_sw/root.pem" -noout -checkend 7776000 >/dev/null 2>&1; then
+    _tn_why="the root certificate is expired or expires within 90 days"
+  fi
+  if [ -z "$_tn_why" ]; then
+    rm -rf "$_tn_sw"; TN_CA_STATE=ok; TN_CA_MSG="the root certificate is acceptable to k3s"; return 0
+  fi
+  if ! tn_ca_find_key "$1" "$_tn_sw/root.pem" && [ -n "$TN_CA_UNREADABLE" ]; then
+    rm -rf "$_tn_sw"; TN_CA_STATE=error; TN_CA_MSG="cannot read $TN_CA_UNREADABLE: run as root"; return 1
+  fi
+  if tn_ca_find_key "$1" "$_tn_sw/root.pem"; then
+    if tn_ca_initialised "$1"; then
+      TN_CA_STATE=needs-rotation; TN_CA_MSG="$_tn_why: k3s v1.34.12/v1.35.9/v1.36.5/v1.37.1 and later will refuse to start; run: sh tn-k3s-ca.sh remediate"
+      rm -rf "$_tn_sw"; return 2
+    fi
+    TN_CA_STATE=needs-regeneration; TN_CA_MSG="$_tn_why, and k3s never finished its first start here: the PKI can simply be regenerated; run: sh tn-k3s-ca.sh remediate"
+    rm -rf "$_tn_sw"; return 3
+  fi
+  TN_CA_STATE=foreign; TN_CA_MSG="$_tn_why, but this is not the Teknoir device CA (no matching key in $_tn_tls/root-ca.key or ${CONFIG_PATH:-/etc/teknoir}/rsa_private.pem)"
+  rm -rf "$_tn_sw"; return 4
+}
+
+# tn_ca_suffix DATA_DIR: "<device-id>.<domain>" for the CN of new CAs
+tn_ca_suffix() {
+  if [ -n "${_DEVICE_ID:-}" ] && [ -n "${_DOMAIN:-}" ]; then echo "${_DEVICE_ID}.${_DOMAIN}"; return 0; fi
+  _tn_f=$1/server/tls/intermediate-ca.pem
+  if [ -f "$_tn_f" ]; then
+    _tn_cn=$("$OPENSSL" x509 -in "$_tn_f" -noout -subject 2>/dev/null | sed -n 's/.*CN *= *//p' | sed 's/,.*//')
+    case $_tn_cn in *@*) echo "${_tn_cn#*@}"; return 0 ;; esac
+  fi
+  echo "$(hostname 2>/dev/null || echo device).local"
+}
+
+# ----------------------------------------------------------------- setup (sourced by the bootstrap scripts)
+
+# tn_ca_pki_current DATA_DIR: 0 if the PKI in server/tls is complete, belongs to the current
+# device key, has a usable root and chains from the leaf CAs to it.
+tn_ca_pki_current() {
+  _tn_tls=$1/server/tls
+  for _tn_f in $TN_CA_BUNDLES root-ca.pem root-ca.key service.key intermediate-ca.pem intermediate-ca.key; do
+    [ -s "$_tn_tls/$_tn_f" ] || return 1
+  done
+  tn_ca_state "$1" >/dev/null || return 1
+  [ "$TN_CA_STATE" = ok ] || return 1
+  [ "$(tn_ca_pubhash_cert "$_tn_tls/root-ca.pem")" = "$(tn_ca_pubhash_key "${CONFIG_PATH:-/etc/teknoir}/rsa_private.pem")" ] || return 1
+  _tn_cw=$(mktemp -d) || return 1
+  _tn_cok=0
+  tn_ca_split "$_tn_tls/server-ca.crt" "$_tn_cw" >/dev/null
+  if "$OPENSSL" verify -CAfile "$_tn_tls/root-ca.pem" -untrusted "$_tn_tls/intermediate-ca.pem" "$_tn_cw/c0.pem" >/dev/null 2>&1; then _tn_cok=1; fi
+  rm -rf "$_tn_cw"
+  [ "$_tn_cok" = 1 ]
+}
+
+# tn_ca_backup_tls DATA_DIR: tar server/tls (if it holds anything) to server/tls-backup-tn-<ts>.tar
+tn_ca_backup_tls() {
+  [ -d "$1/server/tls" ] || return 0
+  _tn_bk="$1/server/tls-backup-tn-$(tn_ca_ts).tar"
+  ( umask 077; tar -C "$1/server" -cf "$_tn_bk" tls ) || { warn "cannot back up $1/server/tls"; return 1; }
+  chmod 600 "$_tn_bk" 2>/dev/null || true
+  # the tar holds keys: keep only the newest one
+  for _tn_o in $(find "$1/server" -maxdepth 1 -type f -name 'tls-backup-tn-*.tar' 2>/dev/null | sort | sed '$d'); do rm -f "$_tn_o"; done
+  info "Previous CA files saved to $_tn_bk"
+}
+
+# tn_ca_install_pki DATA_DIR SUFFIX: build a complete new PKI from the device certificate and
+# replace server/tls with it (the old one is saved first). The data dir must not be initialised.
+tn_ca_install_pki() {
+  _tn_dd=$1 _tn_sfx=$2
+  _tn_cfg=${CONFIG_PATH:-/etc/teknoir}
+  [ -s "$_tn_cfg/rsa_public.pem" ] && [ -s "$_tn_cfg/rsa_private.pem" ] ||
+    { warn "device certificate or key missing in $_tn_cfg"; return 1; }
+  mkdir -p "$_tn_dd/server" || return 1
+  _tn_new=$(mktemp -d "$_tn_dd/server/.tn-tls-new.XXXXXX") || return 1
+  _tn_rt=$(mktemp -d) || { rm -rf "$_tn_new"; return 1; }
+  info "Re-issuing the device certificate as the k3s root CA (keyCertSign)"
+  if ! tn_ca_reissue_root "$_tn_cfg/rsa_public.pem" "$_tn_cfg/rsa_private.pem" "$_tn_rt/root.pem"; then
+    rm -rf "$_tn_new" "$_tn_rt"; return 1
+  fi
+  mkdir -p "$_tn_new/etcd"
+  if ! tn_ca_generate_pki "$_tn_new" "$_tn_rt/root.pem" "$_tn_cfg/rsa_private.pem" "$_tn_sfx"; then
+    warn "PKI generation failed"
+    rm -rf "$_tn_new" "$_tn_rt"; return 1
+  fi
+  rm -rf "$_tn_rt"
+  if [ -d "$_tn_dd/server/tls" ]; then
+    tn_ca_backup_tls "$_tn_dd" || { rm -rf "$_tn_new"; return 1; }
+    # keep an old service account key so tokens issued before stay valid
+    if [ -s "$_tn_dd/server/tls/service.key" ]; then
+      cat "$_tn_dd/server/tls/service.key" >> "$_tn_new/service.key"
+    fi
+    rm -rf "$_tn_dd/server/tls"
+  fi
+  mv "$_tn_new" "$_tn_dd/server/tls" || return 1
+  chmod 750 "$_tn_dd/server/tls" 2>/dev/null || true
+}
+
+# tn_k3s_ca_setup: the bootstrap step. Uses CONFIG_PATH, DATA_DIR, PRODUCT, _DEVICE_ID, _DOMAIN.
+#   never started   -> create the PKI below the re-issued root
+#   started, ok     -> leave everything alone (re-running a bootstrap script is safe)
+#   started, old    -> repair it first (TN_K3S_CA_AUTO_REMEDIATE=false: stop with advice)
+tn_k3s_ca_setup() {
+  info "Prepare K3s CA Certs"
+  export PRODUCT="${PRODUCT:-k3s}"
+  export DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}"
+  tn_ca_openssl || fatal "openssl not found or missing Elliptic Curve (ecparam) support."
+  info "Using ${OPENSSL}: $("$OPENSSL" version)"
+  _tn_cfg=${CONFIG_PATH:-/etc/teknoir}
+  [ -s "$_tn_cfg/rsa_public.pem" ] && [ -s "$_tn_cfg/rsa_private.pem" ] ||
+    fatal "device certificate or key missing in $_tn_cfg"
+
+  if tn_ca_initialised "$DATA_DIR"; then
+    tn_ca_state "$DATA_DIR" || true
+    case $TN_CA_STATE in
+      ok|not-a-server|foreign)
+        info "k3s has already started on this device: the existing CA is left alone ($TN_CA_STATE: $TN_CA_MSG)"
+        return 0 ;;
+      needs-rotation)
+        warn "$TN_CA_MSG"
+        if [ "${TN_K3S_CA_AUTO_REMEDIATE:-true}" != true ]; then
+          fatal "TN_K3S_CA_AUTO_REMEDIATE is not true: run 'sh tn-k3s-ca.sh remediate' and then this script again, or the k3s installer below will break the device"
+        fi
+        info "Repairing the CA of this device before k3s is installed or updated"
+        tn_ca_remediate all || fatal "CA remediation failed; the device was not changed beyond the saved backup. See the messages above"
+        return 0 ;;
+      *) fatal "unexpected CA state '$TN_CA_STATE': $TN_CA_MSG" ;;
+    esac
+  fi
+
+  if tn_ca_pki_current "$DATA_DIR"; then
+    info "A valid CA already exists in ${DATA_DIR}/server/tls (k3s has not started yet): keeping it"
+    return 0
+  fi
+  tn_ca_install_pki "$DATA_DIR" "$(tn_ca_suffix "$DATA_DIR")" || fatal "Cannot generate the k3s CA"
+  return 0
+}
+
+# ----------------------------------------------------------------- remediation
+
+# A staged rotation lives in DATA_DIR/server/.tn-ca-rotate-<ts>/ (mode 700):
+#   server/tls/   the new bootstrap data for `k3s certificate rotate-ca --path`
+#   trust.pem     the server-ca of the running server, trusted via SSL_CERT_FILE for the call
+#   ROTATE_CMD    the exact command; touches ROTATED when it succeeds
+# `finalize` copies the new files into server/tls once ROTATED exists, and removes the dir.
+
+tn_ca_newest_stage() { # DATA_DIR -> prints the newest staging dir, or nothing
+  find "$1/server" -maxdepth 1 -type d -name '.tn-ca-rotate-*' 2>/dev/null | sort | tail -n 1
+}
+
+tn_ca_k3s_bin() { echo "${K3S_BIN:-k3s}"; }
+
+# prepare: stage a rotation (initialised), or regenerate the PKI in place (never started)
+tn_ca_prepare() {
+  _tn_dd=$1
+  tn_ca_state "$_tn_dd" || _tn_rc=$?
+  _tn_rc=${_tn_rc:-0}
+  case $TN_CA_STATE in
+    not-a-server) info "$TN_CA_MSG"; return 0 ;;
+    ok) info "root CA already fine: nothing to do"; return 0 ;;
+    foreign) warn "$TN_CA_MSG"; return 4 ;;
+    needs-regeneration)
+      warn "$TN_CA_MSG"
+      info "Regenerating the PKI in $_tn_dd/server/tls (k3s never finished a start on this device)"
+      tn_ca_install_pki "$_tn_dd" "$(tn_ca_suffix "$_tn_dd")" || return 1
+      # whatever the hung start left behind was made with the old CA
+      info "Done. Restart k3s: it starts from the new CA. Nothing to rotate."
+      return 0 ;;
+    needs-rotation) ;;
+    *) warn "$TN_CA_MSG"; return 1 ;;
+  esac
+
+  if [ -d "$_tn_dd/server/db/etcd" ]; then
+    warn "this server uses embedded etcd: with several servers, read https://docs.k3s.io/cli/certificate first; this tool was tested with one server (sqlite)"
+  fi
+  _tn_tls=$_tn_dd/server/tls
+  _tn_ts=$(tn_ca_ts)
+  _tn_s=$_tn_dd/server/.tn-ca-rotate-$_tn_ts
+  # earlier unfinished stagings hold copies of the keys: drop them
+  find "$_tn_dd/server" -maxdepth 1 -type d -name '.tn-ca-rotate-*' -exec rm -rf {} + 2>/dev/null || true
+  ( umask 077; mkdir -p "$_tn_s/server/tls/etcd" "$_tn_s/w" ) || return 1
+  tn_ca_split "$_tn_tls/server-ca.crt" "$_tn_s/w" >/dev/null || { rm -rf "$_tn_s"; return 1; }
+  tn_ca_lastcert "$_tn_tls/server-ca.crt" "$_tn_s/oldroot.pem" || { rm -rf "$_tn_s"; return 1; }
+  tn_ca_find_key "$_tn_dd" "$_tn_s/oldroot.pem" || { rm -rf "$_tn_s"; return 1; }
+  _tn_key=$TN_CA_KEY
+  tn_ca_reissue_root "$_tn_s/oldroot.pem" "$_tn_key" "$_tn_s/newroot.pem" || { rm -rf "$_tn_s"; return 1; }
+  _tn_oldfp=$(tn_ca_fp "$_tn_s/oldroot.pem")
+
+  # a copy of everything k3s keeps there (keys, service.key, bundles)
+  ( cd "$_tn_tls" && tar -cf - . ) | ( cd "$_tn_s/server/tls" && tar -xf - ) || { rm -rf "$_tn_s"; return 1; }
+  rm -rf "$_tn_s/server/tls/.ca"
+  # every bundle: the old root replaced by the new one, all other certificates kept
+  for _tn_b in $TN_CA_BUNDLES; do
+    [ -f "$_tn_tls/$_tn_b" ] || continue
+    rm -rf "$_tn_s/b"; mkdir -p "$_tn_s/b"
+    _tn_n=$(tn_ca_split "$_tn_tls/$_tn_b" "$_tn_s/b")
+    : > "$_tn_s/server/tls/$_tn_b"
+    _tn_i=0
+    while [ "$_tn_i" -lt "$_tn_n" ]; do
+      if [ "$(tn_ca_fp "$_tn_s/b/c$_tn_i.pem")" = "$_tn_oldfp" ]; then
+        cat "$_tn_s/newroot.pem" >> "$_tn_s/server/tls/$_tn_b"
+      else
+        cat "$_tn_s/b/c$_tn_i.pem" >> "$_tn_s/server/tls/$_tn_b"
+      fi
+      _tn_i=$((_tn_i + 1))
+    done
+  done
+  rm -rf "$_tn_s/b"
+  cp "$_tn_s/newroot.pem" "$_tn_s/server/tls/root-ca.pem"
+
+  # every leaf CA must verify through the new root
+  for _tn_b in server-ca.crt client-ca.crt request-header-ca.crt etcd/peer-ca.crt etcd/server-ca.crt; do
+    [ -f "$_tn_s/server/tls/$_tn_b" ] || continue
+    rm -rf "$_tn_s/b"; mkdir -p "$_tn_s/b"
+    tn_ca_split "$_tn_s/server/tls/$_tn_b" "$_tn_s/b" >/dev/null
+    if ! "$OPENSSL" verify -CAfile "$_tn_s/newroot.pem" -untrusted "$_tn_s/server/tls/intermediate-ca.crt" "$_tn_s/b/c0.pem" >/dev/null 2>&1; then
+      warn "the new root does not verify $_tn_b: nothing was changed"
+      rm -rf "$_tn_s"; return 1
+    fi
+  done
+  rm -rf "$_tn_s/b"
+
+  # k3s only accepts the new bundle if the OLD root can still vouch for the chain (it verifies the
+  # new leaf CAs with the old chain). An old root that has a keyUsage without keyCertSign (the
+  # device-controller certificates) or that has expired cannot (Go refuses such a parent), however
+  # good the new bundle is. Verified above with openssl; then k3s's own check is skipped (--force).
+  _tn_force=
+  if ! "$OPENSSL" x509 -in "$_tn_s/oldroot.pem" -noout -checkend 0 >/dev/null 2>&1; then
+    _tn_force=' --force'; _tn_fwhy="the old root has expired"
+  elif "$OPENSSL" x509 -in "$_tn_s/oldroot.pem" -noout -text | grep -q 'X509v3 Key Usage' && ! tn_ca_has_certsign "$_tn_s/oldroot.pem"; then
+    _tn_force=' --force'; _tn_fwhy="the old root has a key usage without keyCertSign"
+  fi
+  [ -z "$_tn_force" ] || info "rotate-ca will use --force ($_tn_fwhy, so k3s cannot verify the new CA bundle against it); the new bundle was verified here"
+  tn_ca_backup_tls "$_tn_dd" || { rm -rf "$_tn_s"; return 1; }
+  cp "$_tn_s/w/c0.pem" "$_tn_s/trust.pem" || { rm -rf "$_tn_s"; return 1; }
+  rm -rf "$_tn_s/w" "$_tn_s/oldroot.pem"
+  # SSL_CERT_FILE: a post-fix k3s that refuses the old root still has to talk to its own
+  # supervisor. Trusting the running server's own leaf CA for this one call allows that.
+  printf '%s\n' "SSL_CERT_FILE='$_tn_s/trust.pem' $(tn_ca_k3s_bin) certificate rotate-ca --data-dir '$_tn_dd' --path '$_tn_s/server'$_tn_force && touch '$_tn_s/ROTATED'" > "$_tn_s/ROTATE_CMD" ||
+    { rm -rf "$_tn_s"; return 1; }
+  info "Staged $_tn_s"
+  info "Next: run its ROTATE_CMD against the running k3s server (remediate --phase rotate), then --phase finalize and restart k3s"
+}
+
+# rotate: run ROTATE_CMD of the newest staging
+tn_ca_rotate() {
+  _tn_s=$(tn_ca_newest_stage "$1")
+  if [ -z "$_tn_s" ]; then
+    tn_ca_state "$1" >/dev/null || true
+    case $TN_CA_STATE in needs-regeneration|ok|not-a-server) info "nothing to rotate"; return 0 ;; esac
+    warn "no staged rotation in $1/server: run 'remediate --phase prepare' first"; return 1
+  fi
+  [ -f "$_tn_s/ROTATE_CMD" ] || { warn "$_tn_s has no ROTATE_CMD"; return 1; }
+  info "Rotating the CA in the running k3s server (rotate-ca)"
+  if ! sh -c "$(cat "$_tn_s/ROTATE_CMD")"; then
+    warn "k3s certificate rotate-ca failed. Is the k3s server running (systemctl status k3s)? A server that refuses the old root is fine, it only has to be up."
+    warn "Nothing was changed on disk. To go back to a working state: stop k3s and install the previous k3s patch release (v1.34.11, v1.35.8, v1.36.4 or v1.37.0), then run remediate again."
+    return 1
+  fi
+}
+
+# finalize: put the rotated files on disk (k3s keeps them in step with its datastore)
+tn_ca_finalize() {
+  _tn_dd=$1
+  _tn_s=$(tn_ca_newest_stage "$_tn_dd")
+  if [ -z "$_tn_s" ]; then info "nothing to finalize"; return 0; fi
+  [ -f "$_tn_s/ROTATED" ] || { warn "the rotation in $_tn_s has not completed (no ROTATED marker): not touching $_tn_dd/server/tls"; return 1; }
+  for _tn_f in $TN_CA_BUNDLES root-ca.pem; do
+    [ -f "$_tn_s/server/tls/$_tn_f" ] || continue
+    cp "$_tn_s/server/tls/$_tn_f" "$_tn_dd/server/tls/$_tn_f.tn-new" && mv "$_tn_dd/server/tls/$_tn_f.tn-new" "$_tn_dd/server/tls/$_tn_f" || return 1
+  done
+  rm -rf "$_tn_s"
+  info "CA files updated in $_tn_dd/server/tls"
+}
+
+tn_ca_restart() {
+  if [ -n "${TN_K3S_RESTART_CMD:-}" ]; then
+    info "Restarting k3s: $TN_K3S_RESTART_CMD"
+    sh -c "$TN_K3S_RESTART_CMD"
+  elif command -v systemctl >/dev/null 2>&1 && systemctl cat k3s.service >/dev/null 2>&1; then
+    info "Restarting k3s"
+    systemctl restart k3s
+  else
+    warn "restart k3s yourself now (no systemd unit found and TN_K3S_RESTART_CMD is not set)"
+  fi
+}
+
+# tn_ca_remediate PHASE   (prepare | rotate | finalize | all)
+tn_ca_remediate() {
+  tn_ca_openssl || return 1
+  _tn_dd=${DATA_DIR:-/var/lib/rancher/k3s}
+  case $1 in
+    prepare) tn_ca_prepare "$_tn_dd" ;;
+    rotate) tn_ca_rotate "$_tn_dd" ;;
+    finalize) tn_ca_finalize "$_tn_dd" ;;
+    all)
+      tn_ca_state "$_tn_dd" >/dev/null || true
+      case $TN_CA_STATE in
+        ok|not-a-server) info "$TN_CA_MSG"; return 0 ;;
+      esac
+      _tn_was=$TN_CA_STATE
+      tn_ca_prepare "$_tn_dd" || return 1
+      if [ "$_tn_was" = needs-rotation ]; then
+        tn_ca_rotate "$_tn_dd" || return 1
+        tn_ca_finalize "$_tn_dd" || return 1
+      fi
+      tn_ca_restart
+      ;;
+    *) warn "unknown phase '$1' (prepare, rotate, finalize or all)"; return 2 ;;
+  esac
+}
+
+# tn_ca_check: print the state, exit code as documented at the top
+tn_ca_check() {
+  tn_ca_openssl || return 1
+  _tn_rc=0
+  tn_ca_state "${DATA_DIR:-/var/lib/rancher/k3s}" || _tn_rc=$?
+  echo "tn-k3s-ca: ${TN_CA_STATE}: ${TN_CA_MSG}"
+  return "$_tn_rc"
+}
+
+# ----------------------------------------------------------------- program mode
+
+tn_ca_usage() {
+  cat <<'EOF'
+usage: sh tn-k3s-ca.sh check [--data-dir DIR] [--config-dir DIR]
+       sh tn-k3s-ca.sh remediate [--phase prepare|rotate|finalize|all] [--data-dir DIR] [--config-dir DIR]
+
+check       Is the k3s root CA of this device acceptable to k3s v1.34.12/v1.35.9/v1.36.5/v1.37.1+?
+            exit 0 ok, 2 needs rotation, 3 needs regeneration, 4 foreign CA, 1 error
+remediate   Re-issue the root with keyCertSign (same key and subject) and put it in place.
+            Phases: prepare (offline, stages the new files), rotate (k3s certificate rotate-ca against
+            the running server), finalize (copy the files), all (those three plus a k3s restart).
+            A device whose k3s never finished its first start gets its PKI regenerated instead.
+Run as root on the device. Environment: K3S_BIN, TN_K3S_RESTART_CMD, CONFIG_PATH, DATA_DIR.
+EOF
+}
+
+tn_ca_main() {
+  _tn_cmd=$1; shift
+  _tn_phase=all
+  while [ $# -gt 0 ]; do
+    case $1 in
+      --phase) _tn_phase=${2:-}; shift 2 ;;
+      --data-dir) DATA_DIR=${2:-}; shift 2 ;;
+      --config-dir) CONFIG_PATH=${2:-}; shift 2 ;;
+      -h|--help) tn_ca_usage; return 0 ;;
+      *) tn_ca_usage >&2; return 2 ;;
+    esac
+  done
+  export DATA_DIR CONFIG_PATH
+  case $_tn_cmd in
+    check) tn_ca_check ;;
+    remediate)
+      [ "$(id -u)" -eq 0 ] || { warn "run as root"; return 1; }
+      tn_ca_remediate "$_tn_phase" ;;
+  esac
+}
+
+# Only the command words start the program: sourcing this file defines functions and nothing
+# else. (A bootstrap script passes no arguments of its own; the template that embeds this file
+# sets TN_K3S_CA_NO_MAIN anyway.)
+case "${1:-}" in
+  check|remediate)
+    if [ -z "${TN_K3S_CA_NO_MAIN:-}" ]; then
+      DATA_DIR=${DATA_DIR:-/var/lib/rancher/k3s}
+      CONFIG_PATH=${CONFIG_PATH:-/etc/teknoir}
+      tn_ca_main "$@"
+      exit $?
+    fi
+    ;;
+esac
diff --git a/pkg/templates/server.sh.tmpl b/pkg/templates/server.sh.tmpl
index e011413..d0106a7 100644
--- a/pkg/templates/server.sh.tmpl
+++ b/pkg/templates/server.sh.tmpl
@@ -12,6 +12,8 @@
 #   INSTALL_WATCHDOG=true (default: false, enable or disable the teknoir watchdog service)
 #   USE_DOCKER=true (default: false, enable the use of docker as container runtime for k3sm inly works for k3s < 1.24)
 #   CREATE_USER=false (default: ask, create a user for the device without asking)
+#   TN_K3S_CA_AUTO_REMEDIATE=false (default: true; a re-run on a device bootstrapped with the old
+#                          root CA repairs it before k3s is touched. false stops with advice instead)
 
 
 TMP=$(mktemp -dt)
@@ -34,111 +36,12 @@ info "Teknoir bootstrapping...${TMP}"
 {{template "variables.sh.tmpl" .}}
 
 {{template "keys.sh.tmpl" .}}
-info "Prepare K3s CA Certs"
-export PRODUCT="${PRODUCT:-k3s}"
-export DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}"
-
-if command -v openssl-3 >/dev/null 2>&1; then
-  OPENSSL=openssl-3
-else
-  OPENSSL=openssl
-fi
-
-info "Using ${OPENSSL}: $(${OPENSSL} version)"
-
-if ! ${OPENSSL} ecparam -name prime256v1 -genkey -noout -out /dev/null >/dev/null 2>&1; then
-  fatal "openssl not found or missing Elliptic Curve (ecparam) support."
-fi
-
-${OPENSSL} version | grep -qF 'OpenSSL 3' && OPENSSL_GENRSA_FLAGS=-traditional
-
-mkdir -p "${DATA_DIR}/server/tls/etcd"
-
-cp ${CONFIG_PATH}/rsa_public.pem ${DATA_DIR}/server/tls/root-ca.pem
-cp ${CONFIG_PATH}/rsa_private.pem ${DATA_DIR}/server/tls/root-ca.key
-
-cd "${DATA_DIR}/server/tls"
-
-# Set up temporary openssl configuration
-mkdir -p ".ca/certs"
-trap "rm -rf .ca" EXIT
-touch .ca/index
-openssl rand -hex 8 > .ca/serial
-cat >.ca/config <<'EOF'
-[ca]
-default_ca = ca_default
-[ca_default]
-dir = ./.ca
-database = $dir/index
-serial = $dir/serial
-new_certs_dir = $dir/certs
-default_md = sha256
-policy = policy_anything
-[policy_anything]
-commonName = supplied
-[req]
-distinguished_name = req_distinguished_name
-[req_distinguished_name]
-[v3_ca]
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always
-basicConstraints = critical, CA:true
-keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign
-EOF
-
-if [ -e service.key ]; then
-  info "Generating additional Kubernetes service account issuer RSA key"
-  OLD_SERVICE_KEY="$(cat service.key)"
-else
-  info "Generating Kubernetes service account issuer RSA key"
-fi
-${OPENSSL} genrsa ${OPENSSL_GENRSA_FLAGS:-} -out service.key 2048
-echo "${OLD_SERVICE_KEY}" >> service.key
-
-cat root-ca.pem > root-ca.crt
-
-if [ ! -e root-ca.key ]; then
-  fatal "Cannot generate intermediate certificate without root certificate private key"
-fi
-
-info "Generating intermediate certificate authority RSA key and certificate"
-${OPENSSL} genrsa ${OPENSSL_GENRSA_FLAGS:-} -out intermediate-ca.key 4096
-${OPENSSL} req -new -nodes \
-               -subj "/CN=${PRODUCT}-intermediate-ca@${_DEVICE_ID}.${_DOMAIN}" \
-               -key intermediate-ca.key |
-${OPENSSL} ca  -batch -notext -days 3700 \
-               -in /dev/stdin \
-               -out intermediate-ca.pem \
-               -keyfile root-ca.key \
-               -cert root-ca.pem \
-               -config .ca/config \
-               -extensions v3_ca
-
-cat intermediate-ca.pem root-ca.pem > intermediate-ca.crt
-
-if [ ! -e intermediate-ca.key ]; then
-  fatal "Cannot generate leaf certificates without intermediate certificate private key"
-fi
-
-# Generate new leaf CAs for all the control-plane and etcd components
-for TYPE in client server request-header etcd/peer etcd/server; do
-  CERT_NAME="${PRODUCT}-$(echo ${TYPE} | tr / -)-ca"
-  info "Generating ${CERT_NAME} leaf certificate authority EC key and certificate"
-  ${OPENSSL} ecparam -name prime256v1 -genkey -noout -out ${TYPE}-ca.key
-  ${OPENSSL} req -new -nodes \
-                 -subj "/CN=${CERT_NAME}@${_DEVICE_ID}.${_DOMAIN}" \
-                 -key ${TYPE}-ca.key |
-  ${OPENSSL} ca  -batch -notext -days 3700 \
-                 -in /dev/stdin \
-                 -out ${TYPE}-ca.pem \
-                 -keyfile intermediate-ca.key \
-                 -cert intermediate-ca.pem \
-                 -config .ca/config \
-                 -extensions v3_ca
-  cat ${TYPE}-ca.pem \
-      intermediate-ca.pem \
-      root-ca.pem > ${TYPE}-ca.crt
-done
+# The k3s CA of the device: the device certificate becomes the root CA (re-issued with
+# keyCertSign, which k3s >= v1.34.12/v1.35.9/v1.36.5/v1.37.1 requires). The library is also
+# available stand-alone as pkg/templates/scripts/tn-k3s-ca.sh (check / remediate).
+TN_K3S_CA_NO_MAIN=1
+{{template "tn-k3s-ca.sh" .}}
+tn_k3s_ca_setup
 
 info "Install Rancher K3s"
 export K3S_CONFIG_PATH=/etc/rancher/k3s

From b33c6a363a8286563dd15e7159970983dcc612ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anders=20=C3=85slund?= <anders.aslund@teknoir.ai>
Date: Sun, 11 Oct 2026 17:44:07 +0000
Subject: [PATCH 2/2] fix(tn-k3s-ca): do not depend on the caller's
 info/warn/fatal

CI found it: on Debian/Ubuntu `info` is the GNU info reader. The library fell
back to its own logging only if `command -v info` found nothing, so a
stand-alone `sh tn-k3s-ca.sh check|remediate` on a machine with the info
package printed "No menu item ..." instead of its messages. The library now
logs with tn_ca_info/tn_ca_warn/tn_ca_fatal (same format as header.sh.tmpl).
legacy-ca.sh (harness) asks for a function with `type` for the same reason.

Every unit test now runs with a failing `info` binary first in PATH; a
regression test covers the stand-alone and the setup path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 pkg/templates/k3sca_test.go        |  37 ++++++++++
 pkg/templates/scripts/tn-k3s-ca.sh | 112 +++++++++++++++--------------
 test/k3s-ca/legacy-ca.sh           |   5 +-
 3 files changed, 97 insertions(+), 57 deletions(-)

diff --git a/pkg/templates/k3sca_test.go b/pkg/templates/k3sca_test.go
index 2ef7e0b..5efc3a9 100644
--- a/pkg/templates/k3sca_test.go
+++ b/pkg/templates/k3sca_test.go
@@ -101,6 +101,13 @@ func newPKI(t *testing.T) *pki {
 	t.Helper()
 	needTool(t, "sh")
 	needTool(t, "openssl")
+	// every test runs with a failing `info` binary first in PATH, like a Debian/Ubuntu machine
+	// with the GNU info reader: nothing may call it
+	fake := t.TempDir()
+	if err := os.WriteFile(filepath.Join(fake, "info"), []byte("#!/bin/sh\necho GNU-INFO-WAS-CALLED \"$*\" >&2\nexit 1\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", fake+":"+os.Getenv("PATH"))
 	p := &pki{t: t, dir: t.TempDir()}
 	p.cfg = filepath.Join(p.dir, "etc")
 	p.data = filepath.Join(p.dir, "data")
@@ -140,6 +147,9 @@ func (p *pki) sh(script string, env ...string) (string, error) {
 	if bytes.Contains(out, []byte("PRIVATE KEY")) {
 		p.t.Errorf("a private key was printed:\n%s", out)
 	}
+	if bytes.Contains(out, []byte("GNU-INFO-WAS-CALLED")) {
+		p.t.Errorf("the info binary was called:\n%s", out)
+	}
 	return string(out), err
 }
 
@@ -571,6 +581,33 @@ func TestCheckStates(t *testing.T) {
 	}
 }
 
+// On Debian and Ubuntu `info` is the GNU info reader. The library must not depend on a caller's
+// info/warn/fatal, which a stand-alone run does not have.
+func TestStandAloneDoesNotCallTheInfoBinary(t *testing.T) {
+	p := newPKI(t)
+	p.legacyCert()
+	p.legacyPKI(true)
+	bin := t.TempDir()
+	if err := os.WriteFile(filepath.Join(bin, "info"), []byte("#!/bin/sh\necho GNU-INFO-WAS-CALLED \"$*\"\nexit 1\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command("sh", libPath, "check", "--data-dir", p.data, "--config-dir", p.cfg)
+	cmd.Env = append(os.Environ(), "PATH="+bin+":"+os.Getenv("PATH"))
+	out, _ := cmd.CombinedOutput()
+	if strings.Contains(string(out), "GNU-INFO-WAS-CALLED") || !strings.Contains(string(out), "needs-rotation") {
+		t.Errorf("check output: %s", out)
+	}
+	// and the setup path that logs with [INFO] lines
+	q := newPKI(t)
+	q.legacyCert()
+	cmd = exec.Command("sh", "-c", "set -e; set -o noglob; umask 027; . "+libPath+"; tn_k3s_ca_setup")
+	cmd.Env = append(os.Environ(), "PATH="+bin+":"+os.Getenv("PATH"), "CONFIG_PATH="+q.cfg, "DATA_DIR="+q.data, "_DEVICE_ID=dev1", "_DOMAIN=test.local")
+	out, err := cmd.CombinedOutput()
+	if err != nil || strings.Contains(string(out), "GNU-INFO-WAS-CALLED") || !strings.Contains(string(out), "[INFO]") {
+		t.Errorf("setup without info/warn/fatal in the caller: %v\n%s", err, out)
+	}
+}
+
 func TestProgramMode(t *testing.T) {
 	p := newPKI(t)
 	p.legacyCert()
diff --git a/pkg/templates/scripts/tn-k3s-ca.sh b/pkg/templates/scripts/tn-k3s-ca.sh
index 2313223..d6d6ad4 100644
--- a/pkg/templates/scripts/tn-k3s-ca.sh
+++ b/pkg/templates/scripts/tn-k3s-ca.sh
@@ -51,10 +51,12 @@ TN_K3S_CA_LIB_VERSION=1
 export TN_K3S_CA_LIB_VERSION
 
 # ----------------------------------------------------------------- messages
-# info/warn/fatal come from the bootstrap script header. Fallbacks for a bare run.
-command -v info >/dev/null 2>&1 || info() { echo '[INFO] ' "$@"; }
-command -v warn >/dev/null 2>&1 || warn() { echo '[WARN] ' "$@" >&2; }
-command -v fatal >/dev/null 2>&1 || fatal() { echo '[ERROR] ' "$@" >&2; exit 1; }
+# The library prints with its own functions, in the format of header.sh.tmpl. It must not use a
+# caller's info/warn/fatal (there may be none: a stand-alone run) and must not trust `info`
+# to be a function either: on Debian/Ubuntu it is the GNU info reader.
+tn_ca_info() { echo '[INFO] ' "$@"; }
+tn_ca_warn() { echo '[WARN] ' "$@" >&2; }
+tn_ca_fatal() { echo '[ERROR] ' "$@" >&2; exit 1; }
 
 # ----------------------------------------------------------------- small helpers
 
@@ -65,11 +67,11 @@ tn_ca_openssl() {
   elif command -v openssl >/dev/null 2>&1; then
     OPENSSL=openssl
   else
-    warn "openssl not found"
+    tn_ca_warn "openssl not found"
     return 1
   fi
   if ! "$OPENSSL" ecparam -name prime256v1 -genkey -noout -out /dev/null >/dev/null 2>&1; then
-    warn "openssl missing Elliptic Curve (ecparam) support"
+    tn_ca_warn "openssl missing Elliptic Curve (ecparam) support"
     return 1
   fi
   return 0
@@ -141,8 +143,8 @@ EOF
     -set_serial "0x$_tn_serial" -days 7300 -sha256 -out "$3" >/dev/null 2>&1
   _tn_rc=$?
   rm -rf "$_tn_rw"
-  if [ "$_tn_rc" -ne 0 ]; then warn "cannot re-issue the root certificate from $1"; return 1; fi
-  tn_ca_has_certsign "$3" || { warn "re-issued root has no keyCertSign"; return 1; }
+  if [ "$_tn_rc" -ne 0 ]; then tn_ca_warn "cannot re-issue the root certificate from $1"; return 1; fi
+  tn_ca_has_certsign "$3" || { tn_ca_warn "re-issued root has no keyCertSign"; return 1; }
 }
 
 # ----------------------------------------------------------------- PKI generation
@@ -190,13 +192,13 @@ EOF
     # quiet openssl, but show what it said when it fails
     quiet() { "$@" > .ca/log 2>&1 || { cat .ca/log >&2; return 1; }; }
 
-    info "Generating Kubernetes service account issuer RSA key"
+    tn_ca_info "Generating Kubernetes service account issuer RSA key"
     # shellcheck disable=SC2086
     quiet "$OPENSSL" genrsa $GENRSA_FLAGS -out service.key 2048
 
     cat root-ca.pem > root-ca.crt
 
-    info "Generating intermediate certificate authority RSA key and certificate"
+    tn_ca_info "Generating intermediate certificate authority RSA key and certificate"
     # shellcheck disable=SC2086
     quiet "$OPENSSL" genrsa $GENRSA_FLAGS -out intermediate-ca.key 4096
     "$OPENSSL" req -new -nodes -subj "/CN=$(cn "${product}-intermediate-ca@${suffix}")" \
@@ -208,7 +210,7 @@ EOF
     # a new leaf CA for every control-plane and etcd component
     for TYPE in client server request-header etcd/peer etcd/server; do
       name="${product}-$(echo "$TYPE" | tr / -)-ca"
-      info "Generating ${name} leaf certificate authority EC key and certificate"
+      tn_ca_info "Generating ${name} leaf certificate authority EC key and certificate"
       quiet "$OPENSSL" ecparam -name prime256v1 -genkey -noout -out "${TYPE}-ca.key"
       "$OPENSSL" req -new -nodes -subj "/CN=$(cn "${name}@${suffix}")" -key "${TYPE}-ca.key" 2>/dev/null |
       quiet "$OPENSSL" ca -batch -notext -days 3700 -in /dev/stdin -out "${TYPE}-ca.pem" \
@@ -313,11 +315,11 @@ tn_ca_pki_current() {
 tn_ca_backup_tls() {
   [ -d "$1/server/tls" ] || return 0
   _tn_bk="$1/server/tls-backup-tn-$(tn_ca_ts).tar"
-  ( umask 077; tar -C "$1/server" -cf "$_tn_bk" tls ) || { warn "cannot back up $1/server/tls"; return 1; }
+  ( umask 077; tar -C "$1/server" -cf "$_tn_bk" tls ) || { tn_ca_warn "cannot back up $1/server/tls"; return 1; }
   chmod 600 "$_tn_bk" 2>/dev/null || true
   # the tar holds keys: keep only the newest one
   for _tn_o in $(find "$1/server" -maxdepth 1 -type f -name 'tls-backup-tn-*.tar' 2>/dev/null | sort | sed '$d'); do rm -f "$_tn_o"; done
-  info "Previous CA files saved to $_tn_bk"
+  tn_ca_info "Previous CA files saved to $_tn_bk"
 }
 
 # tn_ca_install_pki DATA_DIR SUFFIX: build a complete new PKI from the device certificate and
@@ -326,17 +328,17 @@ tn_ca_install_pki() {
   _tn_dd=$1 _tn_sfx=$2
   _tn_cfg=${CONFIG_PATH:-/etc/teknoir}
   [ -s "$_tn_cfg/rsa_public.pem" ] && [ -s "$_tn_cfg/rsa_private.pem" ] ||
-    { warn "device certificate or key missing in $_tn_cfg"; return 1; }
+    { tn_ca_warn "device certificate or key missing in $_tn_cfg"; return 1; }
   mkdir -p "$_tn_dd/server" || return 1
   _tn_new=$(mktemp -d "$_tn_dd/server/.tn-tls-new.XXXXXX") || return 1
   _tn_rt=$(mktemp -d) || { rm -rf "$_tn_new"; return 1; }
-  info "Re-issuing the device certificate as the k3s root CA (keyCertSign)"
+  tn_ca_info "Re-issuing the device certificate as the k3s root CA (keyCertSign)"
   if ! tn_ca_reissue_root "$_tn_cfg/rsa_public.pem" "$_tn_cfg/rsa_private.pem" "$_tn_rt/root.pem"; then
     rm -rf "$_tn_new" "$_tn_rt"; return 1
   fi
   mkdir -p "$_tn_new/etcd"
   if ! tn_ca_generate_pki "$_tn_new" "$_tn_rt/root.pem" "$_tn_cfg/rsa_private.pem" "$_tn_sfx"; then
-    warn "PKI generation failed"
+    tn_ca_warn "PKI generation failed"
     rm -rf "$_tn_new" "$_tn_rt"; return 1
   fi
   rm -rf "$_tn_rt"
@@ -357,38 +359,38 @@ tn_ca_install_pki() {
 #   started, ok     -> leave everything alone (re-running a bootstrap script is safe)
 #   started, old    -> repair it first (TN_K3S_CA_AUTO_REMEDIATE=false: stop with advice)
 tn_k3s_ca_setup() {
-  info "Prepare K3s CA Certs"
+  tn_ca_info "Prepare K3s CA Certs"
   export PRODUCT="${PRODUCT:-k3s}"
   export DATA_DIR="${DATA_DIR:-/var/lib/rancher/${PRODUCT}}"
-  tn_ca_openssl || fatal "openssl not found or missing Elliptic Curve (ecparam) support."
-  info "Using ${OPENSSL}: $("$OPENSSL" version)"
+  tn_ca_openssl || tn_ca_fatal "openssl not found or missing Elliptic Curve (ecparam) support."
+  tn_ca_info "Using ${OPENSSL}: $("$OPENSSL" version)"
   _tn_cfg=${CONFIG_PATH:-/etc/teknoir}
   [ -s "$_tn_cfg/rsa_public.pem" ] && [ -s "$_tn_cfg/rsa_private.pem" ] ||
-    fatal "device certificate or key missing in $_tn_cfg"
+    tn_ca_fatal "device certificate or key missing in $_tn_cfg"
 
   if tn_ca_initialised "$DATA_DIR"; then
     tn_ca_state "$DATA_DIR" || true
     case $TN_CA_STATE in
       ok|not-a-server|foreign)
-        info "k3s has already started on this device: the existing CA is left alone ($TN_CA_STATE: $TN_CA_MSG)"
+        tn_ca_info "k3s has already started on this device: the existing CA is left alone ($TN_CA_STATE: $TN_CA_MSG)"
         return 0 ;;
       needs-rotation)
-        warn "$TN_CA_MSG"
+        tn_ca_warn "$TN_CA_MSG"
         if [ "${TN_K3S_CA_AUTO_REMEDIATE:-true}" != true ]; then
-          fatal "TN_K3S_CA_AUTO_REMEDIATE is not true: run 'sh tn-k3s-ca.sh remediate' and then this script again, or the k3s installer below will break the device"
+          tn_ca_fatal "TN_K3S_CA_AUTO_REMEDIATE is not true: run 'sh tn-k3s-ca.sh remediate' and then this script again, or the k3s installer below will break the device"
         fi
-        info "Repairing the CA of this device before k3s is installed or updated"
-        tn_ca_remediate all || fatal "CA remediation failed; the device was not changed beyond the saved backup. See the messages above"
+        tn_ca_info "Repairing the CA of this device before k3s is installed or updated"
+        tn_ca_remediate all || tn_ca_fatal "CA remediation failed; the device was not changed beyond the saved backup. See the messages above"
         return 0 ;;
-      *) fatal "unexpected CA state '$TN_CA_STATE': $TN_CA_MSG" ;;
+      *) tn_ca_fatal "unexpected CA state '$TN_CA_STATE': $TN_CA_MSG" ;;
     esac
   fi
 
   if tn_ca_pki_current "$DATA_DIR"; then
-    info "A valid CA already exists in ${DATA_DIR}/server/tls (k3s has not started yet): keeping it"
+    tn_ca_info "A valid CA already exists in ${DATA_DIR}/server/tls (k3s has not started yet): keeping it"
     return 0
   fi
-  tn_ca_install_pki "$DATA_DIR" "$(tn_ca_suffix "$DATA_DIR")" || fatal "Cannot generate the k3s CA"
+  tn_ca_install_pki "$DATA_DIR" "$(tn_ca_suffix "$DATA_DIR")" || tn_ca_fatal "Cannot generate the k3s CA"
   return 0
 }
 
@@ -412,22 +414,22 @@ tn_ca_prepare() {
   tn_ca_state "$_tn_dd" || _tn_rc=$?
   _tn_rc=${_tn_rc:-0}
   case $TN_CA_STATE in
-    not-a-server) info "$TN_CA_MSG"; return 0 ;;
-    ok) info "root CA already fine: nothing to do"; return 0 ;;
-    foreign) warn "$TN_CA_MSG"; return 4 ;;
+    not-a-server) tn_ca_info "$TN_CA_MSG"; return 0 ;;
+    ok) tn_ca_info "root CA already fine: nothing to do"; return 0 ;;
+    foreign) tn_ca_warn "$TN_CA_MSG"; return 4 ;;
     needs-regeneration)
-      warn "$TN_CA_MSG"
-      info "Regenerating the PKI in $_tn_dd/server/tls (k3s never finished a start on this device)"
+      tn_ca_warn "$TN_CA_MSG"
+      tn_ca_info "Regenerating the PKI in $_tn_dd/server/tls (k3s never finished a start on this device)"
       tn_ca_install_pki "$_tn_dd" "$(tn_ca_suffix "$_tn_dd")" || return 1
       # whatever the hung start left behind was made with the old CA
-      info "Done. Restart k3s: it starts from the new CA. Nothing to rotate."
+      tn_ca_info "Done. Restart k3s: it starts from the new CA. Nothing to rotate."
       return 0 ;;
     needs-rotation) ;;
-    *) warn "$TN_CA_MSG"; return 1 ;;
+    *) tn_ca_warn "$TN_CA_MSG"; return 1 ;;
   esac
 
   if [ -d "$_tn_dd/server/db/etcd" ]; then
-    warn "this server uses embedded etcd: with several servers, read https://docs.k3s.io/cli/certificate first; this tool was tested with one server (sqlite)"
+    tn_ca_warn "this server uses embedded etcd: with several servers, read https://docs.k3s.io/cli/certificate first; this tool was tested with one server (sqlite)"
   fi
   _tn_tls=$_tn_dd/server/tls
   _tn_ts=$(tn_ca_ts)
@@ -470,7 +472,7 @@ tn_ca_prepare() {
     rm -rf "$_tn_s/b"; mkdir -p "$_tn_s/b"
     tn_ca_split "$_tn_s/server/tls/$_tn_b" "$_tn_s/b" >/dev/null
     if ! "$OPENSSL" verify -CAfile "$_tn_s/newroot.pem" -untrusted "$_tn_s/server/tls/intermediate-ca.crt" "$_tn_s/b/c0.pem" >/dev/null 2>&1; then
-      warn "the new root does not verify $_tn_b: nothing was changed"
+      tn_ca_warn "the new root does not verify $_tn_b: nothing was changed"
       rm -rf "$_tn_s"; return 1
     fi
   done
@@ -486,7 +488,7 @@ tn_ca_prepare() {
   elif "$OPENSSL" x509 -in "$_tn_s/oldroot.pem" -noout -text | grep -q 'X509v3 Key Usage' && ! tn_ca_has_certsign "$_tn_s/oldroot.pem"; then
     _tn_force=' --force'; _tn_fwhy="the old root has a key usage without keyCertSign"
   fi
-  [ -z "$_tn_force" ] || info "rotate-ca will use --force ($_tn_fwhy, so k3s cannot verify the new CA bundle against it); the new bundle was verified here"
+  [ -z "$_tn_force" ] || tn_ca_info "rotate-ca will use --force ($_tn_fwhy, so k3s cannot verify the new CA bundle against it); the new bundle was verified here"
   tn_ca_backup_tls "$_tn_dd" || { rm -rf "$_tn_s"; return 1; }
   cp "$_tn_s/w/c0.pem" "$_tn_s/trust.pem" || { rm -rf "$_tn_s"; return 1; }
   rm -rf "$_tn_s/w" "$_tn_s/oldroot.pem"
@@ -494,8 +496,8 @@ tn_ca_prepare() {
   # supervisor. Trusting the running server's own leaf CA for this one call allows that.
   printf '%s\n' "SSL_CERT_FILE='$_tn_s/trust.pem' $(tn_ca_k3s_bin) certificate rotate-ca --data-dir '$_tn_dd' --path '$_tn_s/server'$_tn_force && touch '$_tn_s/ROTATED'" > "$_tn_s/ROTATE_CMD" ||
     { rm -rf "$_tn_s"; return 1; }
-  info "Staged $_tn_s"
-  info "Next: run its ROTATE_CMD against the running k3s server (remediate --phase rotate), then --phase finalize and restart k3s"
+  tn_ca_info "Staged $_tn_s"
+  tn_ca_info "Next: run its ROTATE_CMD against the running k3s server (remediate --phase rotate), then --phase finalize and restart k3s"
 }
 
 # rotate: run ROTATE_CMD of the newest staging
@@ -503,14 +505,14 @@ tn_ca_rotate() {
   _tn_s=$(tn_ca_newest_stage "$1")
   if [ -z "$_tn_s" ]; then
     tn_ca_state "$1" >/dev/null || true
-    case $TN_CA_STATE in needs-regeneration|ok|not-a-server) info "nothing to rotate"; return 0 ;; esac
-    warn "no staged rotation in $1/server: run 'remediate --phase prepare' first"; return 1
+    case $TN_CA_STATE in needs-regeneration|ok|not-a-server) tn_ca_info "nothing to rotate"; return 0 ;; esac
+    tn_ca_warn "no staged rotation in $1/server: run 'remediate --phase prepare' first"; return 1
   fi
-  [ -f "$_tn_s/ROTATE_CMD" ] || { warn "$_tn_s has no ROTATE_CMD"; return 1; }
-  info "Rotating the CA in the running k3s server (rotate-ca)"
+  [ -f "$_tn_s/ROTATE_CMD" ] || { tn_ca_warn "$_tn_s has no ROTATE_CMD"; return 1; }
+  tn_ca_info "Rotating the CA in the running k3s server (rotate-ca)"
   if ! sh -c "$(cat "$_tn_s/ROTATE_CMD")"; then
-    warn "k3s certificate rotate-ca failed. Is the k3s server running (systemctl status k3s)? A server that refuses the old root is fine, it only has to be up."
-    warn "Nothing was changed on disk. To go back to a working state: stop k3s and install the previous k3s patch release (v1.34.11, v1.35.8, v1.36.4 or v1.37.0), then run remediate again."
+    tn_ca_warn "k3s certificate rotate-ca failed. Is the k3s server running (systemctl status k3s)? A server that refuses the old root is fine, it only has to be up."
+    tn_ca_warn "Nothing was changed on disk. To go back to a working state: stop k3s and install the previous k3s patch release (v1.34.11, v1.35.8, v1.36.4 or v1.37.0), then run remediate again."
     return 1
   fi
 }
@@ -519,25 +521,25 @@ tn_ca_rotate() {
 tn_ca_finalize() {
   _tn_dd=$1
   _tn_s=$(tn_ca_newest_stage "$_tn_dd")
-  if [ -z "$_tn_s" ]; then info "nothing to finalize"; return 0; fi
-  [ -f "$_tn_s/ROTATED" ] || { warn "the rotation in $_tn_s has not completed (no ROTATED marker): not touching $_tn_dd/server/tls"; return 1; }
+  if [ -z "$_tn_s" ]; then tn_ca_info "nothing to finalize"; return 0; fi
+  [ -f "$_tn_s/ROTATED" ] || { tn_ca_warn "the rotation in $_tn_s has not completed (no ROTATED marker): not touching $_tn_dd/server/tls"; return 1; }
   for _tn_f in $TN_CA_BUNDLES root-ca.pem; do
     [ -f "$_tn_s/server/tls/$_tn_f" ] || continue
     cp "$_tn_s/server/tls/$_tn_f" "$_tn_dd/server/tls/$_tn_f.tn-new" && mv "$_tn_dd/server/tls/$_tn_f.tn-new" "$_tn_dd/server/tls/$_tn_f" || return 1
   done
   rm -rf "$_tn_s"
-  info "CA files updated in $_tn_dd/server/tls"
+  tn_ca_info "CA files updated in $_tn_dd/server/tls"
 }
 
 tn_ca_restart() {
   if [ -n "${TN_K3S_RESTART_CMD:-}" ]; then
-    info "Restarting k3s: $TN_K3S_RESTART_CMD"
+    tn_ca_info "Restarting k3s: $TN_K3S_RESTART_CMD"
     sh -c "$TN_K3S_RESTART_CMD"
   elif command -v systemctl >/dev/null 2>&1 && systemctl cat k3s.service >/dev/null 2>&1; then
-    info "Restarting k3s"
+    tn_ca_info "Restarting k3s"
     systemctl restart k3s
   else
-    warn "restart k3s yourself now (no systemd unit found and TN_K3S_RESTART_CMD is not set)"
+    tn_ca_warn "restart k3s yourself now (no systemd unit found and TN_K3S_RESTART_CMD is not set)"
   fi
 }
 
@@ -552,7 +554,7 @@ tn_ca_remediate() {
     all)
       tn_ca_state "$_tn_dd" >/dev/null || true
       case $TN_CA_STATE in
-        ok|not-a-server) info "$TN_CA_MSG"; return 0 ;;
+        ok|not-a-server) tn_ca_info "$TN_CA_MSG"; return 0 ;;
       esac
       _tn_was=$TN_CA_STATE
       tn_ca_prepare "$_tn_dd" || return 1
@@ -562,7 +564,7 @@ tn_ca_remediate() {
       fi
       tn_ca_restart
       ;;
-    *) warn "unknown phase '$1' (prepare, rotate, finalize or all)"; return 2 ;;
+    *) tn_ca_warn "unknown phase '$1' (prepare, rotate, finalize or all)"; return 2 ;;
   esac
 }
 
@@ -608,7 +610,7 @@ tn_ca_main() {
   case $_tn_cmd in
     check) tn_ca_check ;;
     remediate)
-      [ "$(id -u)" -eq 0 ] || { warn "run as root"; return 1; }
+      [ "$(id -u)" -eq 0 ] || { tn_ca_warn "run as root"; return 1; }
       tn_ca_remediate "$_tn_phase" ;;
   esac
 }
diff --git a/test/k3s-ca/legacy-ca.sh b/test/k3s-ca/legacy-ca.sh
index 1f05b39..3677e44 100644
--- a/test/k3s-ca/legacy-ca.sh
+++ b/test/k3s-ca/legacy-ca.sh
@@ -19,8 +19,9 @@
 # Environment: PRODUCT (default k3s). OPENSSL is detected as in the template.
 # Needs info() and fatal(); fallbacks are defined below.
 
-command -v info >/dev/null 2>&1 || info() { echo '[INFO] ' "$@"; }
-command -v fatal >/dev/null 2>&1 || fatal() { echo '[ERROR] ' "$@" >&2; exit 1; }
+# (`command -v info` would find the GNU info reader on Debian/Ubuntu: ask for a function)
+case $(type info 2>/dev/null) in *function*) ;; *) info() { echo '[INFO] ' "$@"; } ;; esac
+case $(type fatal 2>/dev/null) in *function*) ;; *) fatal() { echo '[ERROR] ' "$@" >&2; exit 1; } ;; esac
 
 tn_legacy_ca() {
   _tn_tls=$1 _tn_cert=$2 _tn_key=$3 _tn_suffix=${4:-device-0.test.local}