Implement QR-based pairing and mTLS trust establishment #7

New issue

Open

opened 2026-09-02 15:25:47 +02:00 by emidab · 0 comments

emidab commented

2026-09-02 15:25:47 +02:00

Owner

Summary

Implement QR-based pairing/trust establishment: each device scans the other's QR to exchange and pin its certificate/fingerprint. No PIN or password — mTLS alone is sufficient.

What to do

Generate/derive per-device self-signed identity cert
Render the device's fingerprint as a scannable QR code
Scan another device's QR and pin its fingerprint
Mutual exchange so both ends trust each other (mTLS)
Persist pinned peers and allow unpairing

Acceptance criteria

Device shows its own pairing QR
Scanning a peer's QR exchanges and pins cert, both directions
After pairing, both devices trust each other (mTLS handshake succeeds)
Pinned peers persist across restarts
Works headless with fake camera/QR scanner on CI

Notes

Trust model per networking architecture doc (no central CA)
Prefer a well-established QR scanning package over a custom one

## Summary Implement QR-based pairing/trust establishment: each device scans the other's QR to exchange and pin its certificate/fingerprint. No PIN or password — mTLS alone is sufficient. ## What to do 1. Generate/derive per-device self-signed identity cert 2. Render the device's fingerprint as a scannable QR code 3. Scan another device's QR and pin its fingerprint 4. Mutual exchange so both ends trust each other (mTLS) 5. Persist pinned peers and allow unpairing ## Acceptance criteria - [ ] Device shows its own pairing QR - [ ] Scanning a peer's QR exchanges and pins cert, both directions - [ ] After pairing, both devices trust each other (mTLS handshake succeeds) - [ ] Pinned peers persist across restarts - [ ] Works headless with fake camera/QR scanner on CI ## Notes - Trust model per networking architecture doc (no central CA) - Prefer a well-established QR scanning package over a custom one