certctl

000001_initial_schema.down.sql

Implement M3: expiration threshold alerting with dedup and status transitions

2026-03-15 00:03:43 -04:00

000001_initial_schema.up.sql

perf: add 5 database indexes for scheduler query optimization

2026-03-20 01:20:21 -04:00

000002_agent_metadata.down.sql

feat: M10 — agent metadata collection, Apache httpd + HAProxy target connectors

2026-03-20 02:19:28 -04:00

000002_agent_metadata.up.sql

feat: M10 — agent metadata collection, Apache httpd + HAProxy target connectors

2026-03-20 02:19:28 -04:00

000003_certificate_profiles.down.sql

feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry

2026-03-20 20:39:49 -04:00

000003_certificate_profiles.up.sql

feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry

2026-03-20 20:39:49 -04:00

000004_agent_groups.down.sql

feat: M11b — ownership tracking, agent groups, interactive renewal approval

2026-03-20 21:02:35 -04:00

000004_agent_groups.up.sql

feat: M11b — ownership tracking, agent groups, interactive renewal approval

2026-03-20 21:02:35 -04:00

000005_revocation.down.sql

feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications

2026-03-22 10:59:18 -04:00

000005_revocation.up.sql

feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications

2026-03-22 10:59:18 -04:00

000006_discovery.down.sql

feat: M18b Filesystem Certificate Discovery — agent scanning, server dedup, triage API

2026-03-24 00:25:00 -04:00

000006_discovery.up.sql

feat: M18b Filesystem Certificate Discovery — agent scanning, server dedup, triage API

2026-03-24 00:25:00 -04:00

000007_network_discovery.down.sql

feat: add network certificate discovery (M21) and Prometheus metrics (M22)

2026-03-24 23:37:47 -04:00

000007_network_discovery.up.sql

feat: add network certificate discovery (M21) and Prometheus metrics (M22)

2026-03-24 23:37:47 -04:00

000008_verification.down.sql

feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets

2026-03-27 21:07:16 -04:00

000008_verification.up.sql

feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets

2026-03-27 21:07:16 -04:00

000009_issuer_config.down.sql

feat(M34): dynamic issuer configuration with encrypted config storage

2026-04-04 00:20:13 -04:00

000009_issuer_config.up.sql

feat(M34): dynamic issuer configuration with encrypted config storage

2026-04-04 00:20:13 -04:00

000010_target_config.down.sql

feat(M35): dynamic target configuration with encrypted config, test connection, and GUI updates

2026-04-04 01:09:53 -04:00

000010_target_config.up.sql

feat(M35): dynamic target configuration with encrypted config, test connection, and GUI updates

2026-04-04 01:09:53 -04:00

000011_health_checks.down.sql

feat(M48): continuous TLS health monitoring — endpoint state machine, shared tlsprobe, 8 API endpoints, GUI

2026-04-15 21:45:45 -04:00

000011_health_checks.up.sql

feat(M48): continuous TLS health monitoring — endpoint state machine, shared tlsprobe, 8 API endpoints, GUI

2026-04-15 21:45:45 -04:00

000012_revocation_index_scope.down.sql

security: scope revocation unique index to (issuer_id, serial_number) (fixes H-1)

2026-04-16 21:49:59 +00:00

000012_revocation_index_scope.up.sql

security: scope revocation unique index to (issuer_id, serial_number) (fixes H-1)

2026-04-16 21:49:59 +00:00

000013_policy_rule_severity.down.sql

fix(policies): stop 400ing the "+ New Policy" button + add per-rule severity (D-005, D-006)

2026-04-18 13:02:04 +00:00

000013_policy_rule_severity.up.sql

fix(policies): stop 400ing the "+ New Policy" button + add per-rule severity (D-005, D-006)

2026-04-18 13:02:04 +00:00

000014_policy_violation_severity_check.down.sql

fix(policies): close the D-006 loop — TitleCase seed canonicals + severity-aware, config-consuming rule engine (D-008)

2026-04-18 14:55:56 +00:00

000014_policy_violation_severity_check.up.sql

Bundle C: Renewal/reliability cluster — 7 findings closed

2026-04-27 00:08:25 +00:00

000015_agent_retire.down.sql

Close I-004 (agent hard-delete cascades targets) coverage-gap finding

2026-04-19 05:24:00 +00:00

000015_agent_retire.up.sql

Close I-004 (agent hard-delete cascades targets) coverage-gap finding

2026-04-19 05:24:00 +00:00

000016_notification_retry.down.sql

I-005: notification retry loop + dead-letter queue

2026-04-19 15:17:27 +00:00

000016_notification_retry.up.sql

I-005: notification retry loop + dead-letter queue

2026-04-19 15:17:27 +00:00

000017_db_coupling_cleanup.down.sql

fix(deploy,db,handler): close fresh-clone postgres init failure + 4 ride-along audit findings (U-3 master)

2026-04-25 13:29:23 +00:00

000017_db_coupling_cleanup.up.sql

fix(deploy,db,handler): close fresh-clone postgres init failure + 4 ride-along audit findings (U-3 master)

2026-04-25 13:29:23 +00:00

000018_audit_events_worm.down.sql

fix(bundle-6): Audit Integrity + Privacy — 3 audit findings closed

2026-04-26 00:26:44 +00:00

000018_audit_events_worm.up.sql

fix(bundle-6): Audit Integrity + Privacy — 3 audit findings closed

2026-04-26 00:26:44 +00:00

000019_crl_cache.down.sql

crl/cache: schema + repository for crl_cache + crl_generation_events

2026-04-28 23:45:18 +00:00

000019_crl_cache.up.sql

crl/cache: schema + repository for crl_cache + crl_generation_events

2026-04-28 23:45:18 +00:00

000020_ocsp_responder.down.sql

ocsp/responder: dedicated OCSP responder cert per issuer (RFC 6960 §2.6)

2026-04-28 23:55:52 +00:00

000020_ocsp_responder.up.sql

ocsp/responder: dedicated OCSP responder cert per issuer (RFC 6960 §2.6)

2026-04-28 23:55:52 +00:00

000021_scep_probe_results.down.sql

feat(scep): SCEP probe in network scanner for fleet-readiness assessment

2026-04-29 18:51:57 +00:00

000021_scep_probe_results.up.sql

feat(scep): SCEP probe in network scanner for fleet-readiness assessment

2026-04-29 18:51:57 +00:00

000022_certificate_profiles_csrattrs.down.sql

EST RFC 7030 hardening master bundle Phases 5-7: end-to-end serverkeygen

2026-04-29 23:57:45 +00:00

000022_certificate_profiles_csrattrs.up.sql

EST RFC 7030 hardening master bundle Phases 5-7: end-to-end serverkeygen

2026-04-29 23:57:45 +00:00

000023_managed_certificates_source.down.sql

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

000023_managed_certificates_source.up.sql

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

000024_ocsp_response_cache.down.sql

feat(ocsp): pre-signed response cache + invalidate-on-revoke (Phase 2)

2026-04-30 05:03:01 +00:00

000024_ocsp_response_cache.up.sql

feat(ocsp): pre-signed response cache + invalidate-on-revoke (Phase 2)

2026-04-30 05:03:01 +00:00

000025_acme_server.down.sql

acme-server: foundation — directory + new-nonce + per-profile routing (Phase 1a/7)

2026-05-03 12:55:40 +00:00

000025_acme_server.up.sql

acme-server: foundation — directory + new-nonce + per-profile routing (Phase 1a/7)

2026-05-03 12:55:40 +00:00

000026_renewal_policy_channel_matrix.down.sql

notifications: per-policy multi-channel expiry-alert routing

2026-05-03 22:12:32 +00:00

000026_renewal_policy_channel_matrix.up.sql

Revert "chore: drop 'Infisical' label from internal references"

2026-05-04 01:18:15 +00:00

000027_approval_workflow.down.sql

domain, migrations: ApprovalRequest type + issuance_approval_requests + RequiresApproval

2026-05-04 00:55:17 +00:00

000027_approval_workflow.up.sql

Revert "chore: drop 'Infisical' label from internal references"

2026-05-04 01:18:15 +00:00

seed_demo.sql

Revert "chore: drop 'Infisical' label from internal references"

2026-05-04 01:18:15 +00:00

seed_test.sql

feat: S/MIME certificate support in integration tests + test env docs

2026-04-02 18:32:57 -04:00

seed.sql

fix(deploy,db,handler): close fresh-clone postgres init failure + 4 ride-along audit findings (U-3 master)

2026-04-25 13:29:23 +00:00