TLS Certificate Usage

Stage: Alpha Status: Draft

Mount generated certificates read-only into containers:

podman run --rm \
  -v .localdev/certs/demo.local:/certs:ro,Z \
  -p 8444:443 \
  nginx

Use:

• /certs/tls.key for the private key.
• /certs/tls.crt for the issued certificate.
• /certs/fullchain.crt for servers that expect the leaf certificate plus chain.
• /certs/ca-chain.crt for trust-chain debugging.

Keep tls.key out of images. Mount it at runtime from host storage, a secret manager, or a Kubernetes Secret.