fix(traefik): keep bootstrap certificate CN short

Author: terion-labs

ansible/roles/traefik/templates/bootstrap-cert-openssl.cnf.j2

@@ -4,7 +4,7 @@ x509_extensions = v3_req
 prompt = no
 
 [dn]
-CN = {{ terrarium_bootstrap_tls_domains[0] }}
+CN = terrarium-bootstrap
 
 [v3_req]
 basicConstraints = critical, CA:true, pathlen:0

tests/ansible-bootstrap-cert.test.ts

@@ -14,9 +14,12 @@ describe("Traefik bootstrap certificate template", () => {
   test("marks the self-signed bootstrap certificate as a CA trusted for server auth", () => {
     const template = readFileSync(join(repoRoot, "ansible/roles/traefik/templates/bootstrap-cert-openssl.cnf.j2"), "utf8");
 
+    expect(template).toContain("CN = terrarium-bootstrap");
+    expect(template).not.toContain("CN = {{ terrarium_bootstrap_tls_domains[0] }}");
     expect(template).toContain("basicConstraints = critical, CA:true");
     expect(template).toContain("keyCertSign");
     expect(template).toContain("extendedKeyUsage = serverAuth");
+    expect(template).toContain("subjectAltName = @alt_names");
   });
 
   test("limits bootstrap TLS to local-IDP auth and removes it when unused", () => {