From f36a1cbf111b2507e677a7bec7631ce6b227834c Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 12:25:28 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20NATS=20Bao=20ACME=20?=
 =?UTF-8?q?=E8=AF=81=E4=B9=A6=E5=AF=86=E9=92=A5=E7=B1=BB=E5=9E=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/nats/README.md        | 2 ++
 platform/nats/certificate.yaml | 5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/platform/nats/README.md b/platform/nats/README.md
index 645922a..3f54b0c 100644
--- a/platform/nats/README.md
+++ b/platform/nats/README.md
@@ -12,6 +12,8 @@
   使用 `nats.nats.svc.cluster.local:4222`。访问控制由 TLS、Account 与用户权限负责，
   不额外维护易漂移的源 IP 白名单。
 - TLS 证书由 `bao-acme` 签发。PVE 节点已信任内部 CA。
+- `bao-server` PKI role 只接受 RSA CSR，因此 Certificate 使用 RSA 2048；不要改成
+  ECDSA，ACME challenge 会成功但 finalize 会以 `role requires keys of type rsa` 失败。
 - `SYS` Account 用于管理；`CI` Account 启用 JetStream，存储上限 1 GiB。
 
 首期使用静态用户，密码只存在 OpenBao `kv/k8s/nats`：
diff --git a/platform/nats/certificate.yaml b/platform/nats/certificate.yaml
index 441b6ff..17cf97b 100644
--- a/platform/nats/certificate.yaml
+++ b/platform/nats/certificate.yaml
@@ -15,6 +15,7 @@ spec:
   duration: 720h
   renewBefore: 168h
   privateKey:
-    algorithm: ECDSA
-    size: 256
+    # OpenBao's bao-server role intentionally accepts RSA keys only.
+    algorithm: RSA
+    size: 2048
     rotationPolicy: Always