topic: cert

13 modules sharing the cert name family (derived from the tree's prefix discipline).

The 'cert' topic family in the Nishi sovereign ecosystem manages TLS certificate lifecycle and trust within the no-JS hosting model. nx_cert_autorenew handles auto-renewal logic for wildcard TLS certs, while nx_cert_loader bridges certificate registry data to TLS handshakes, ensuring correct byte delivery. nx_cert_gen provides a CLI tool for generating self-signed X.509 certs, supporting secure domain identity establishment.

auto-narrated by the local model from this topic's module headers; links verified against the wiki index.

narrated overview -- maintained by the narration lane, module links verified against this wiki.

module	description	lines	funcs
nx_cert_autorenew.nx	SOVEREIGN AUTO-RENEWAL for the per-domain wildcard TLS certs.	360	18
nx_cert_autorenew_gate.nx	SOVEREIGN gate for the per-domain wildcard cert AUTO-RENEWAL logic.	69	2
nx_cert_autorenew_lib.nx	PURE mapping + threshold logic for the per-domain wildcard TLS	80	9
nx_cert_carrier.nx	the BACKEND trust side of the sovereign no-JS cert carrier (rung 3 of the hosting	121	8
nx_cert_carrier_gate.nx		68	4
nx_cert_debug.nx	debug why nx_cert_monitor misparsed the real fullchain cert. Prints x509_parse's	52	4
nx_cert_gen.nx	V-HOST-4c: sovereign X.509 self-signed cert CLI driver.	398	8
nx_cert_loader.nx	the DATA bridge from the cert REGISTRY (paths) to the TLS handshake (BYTES). The reconciled	29	1
nx_cert_loader_gate.nx	gate for the cert data-loader. Writes fixture chain/key files, then asserts cl_load	61	7
nx_cert_monitor.nx	CERT-EXPIRY MONITOR (closes hosting_research gap #3 "cert-expiry-monitor", 3/0	88	9
nx_cert_monitor_gate.nx	KAT for the cert-expiry monitor. Hand-builds a validity field (two UTCTime	56	2
nx_cert_registry.nx	the S-CLASS DATA-DRIVEN CERT REGISTRY (SNI host -> per-domain TLS chain+key). The LOGIC	103	10
nx_cert_registry_gate.nx	PURE gate for the data-driven SNI cert registry. Proves: EXACT host beats wildcard,	63	6