nx_cert_gen.nx

nx_cert_gen.nx -- V-HOST-4c: sovereign X.509 self-signed cert CLI driver. Closes the openssl bridge from NISHI_ANDELINWEST_DEPLOY_PLAYBOOK §3. Full sovereign Zone S cert generation per License Containment Cardinal. USAGE (V1 hardcoded; V-PROV-1 CLI argv parser extends): nx_cert_gen.elf \ --domain andelinwest.com \ --san www.andelinwest.com,wiki.andelinwest.com \ --validity-days 365 \ --out-dir /var/nishi-host/certs/andelinwest/ Produces: /var/nishi-host/certs/andelinwest/cert.der (X.509 v3 self-signed) /var/nishi-host/certs/andelinwest/priv.ed25519 (32-byte raw priv) /var/nishi-host/certs/andelinwest/pub.ed25519 (32-byte raw pub; for verify) COMPOSES (per "avoid duplicate primitives"): hub/nx_x509_build (V-HOST-4b; X.509 v3 builder) hub/nx_asn1_write (V-HOST-4a; DER encoder; transitively) nx_csprng (sovereign CSPRNG; sys_getrandom OR /dev/urandom) nx_ed25519_signature (ed25519_pub_from_priv just added) nx_syscalls (sys_now_ms; sys_openat_wr; sys_write; sys_close) V-HOST-4c SCOPE: - Generate 32-byte Ed25519 priv via nx_csprng_fill - Derive 32-byte pub via ed25519_pub_from_priv - Compute notBefore (now Unix sec -> GeneralizedTime) + notAfter (now + validity_days) - Build cert DER via nx_x509_build_self_signed - Write cert.der + priv.ed25519 + pub.ed25519 to disk V-HOST-4c NON-SCOPE: - Full argv parsing (V-PROV-1 CLI; V-HOST-4c uses hardcoded for V1 demo) - PEM emit (only DER; convert via existing nx_pem_encode if shipped) - chmod 0600 on priv (operator does this post-creation; or sys_chmod V+1) Status: V-HOST-4c. 2026-05-27.