cce/vars now enrolls against our own broker, whose Vault minted its own root CA on 2026-09-07 (SHA-256 73:74:A5:2B...:C1:F6). The pinned copy still held the test broker's, so the master bridgehead could not have verified a single proxy certificate. itcc/ and kr/ keep the old file -- they still enroll against test-no-real-data.broker.samply.de.
The CCE broker is live at broker.cce.dkfz.de, so the test broker at
test-no-real-data.broker.samply.de is no longer the CCE broker. BROKER_ID
roots the Beam PKI namespace, so this moves the proxy id to
cce-master.broker.cce.dkfz.de and the app ids derived from it --
cce/root.crt.pem still pins the old broker's CA and must be replaced with the
new one, and the proxy has to be re-enrolled before the bridgehead connects
again.
Manoj Waikar