cce/vars now enrolls against our own broker, whose Vault minted its own
root CA on 2026-09-07 (SHA-256 73:74:A5:2B...:C1:F6). The pinned copy
still held the test broker's, so the master bridgehead could not have
verified a single proxy certificate. itcc/ and kr/ keep the old file --
they still enroll against test-no-real-data.broker.samply.de.
The CCE broker is live at broker.cce.dkfz.de, so the test broker at
test-no-real-data.broker.samply.de is no longer the CCE broker.
BROKER_ID roots the Beam PKI namespace, so this moves the proxy id to
cce-master.broker.cce.dkfz.de and the app ids derived from it --
cce/root.crt.pem still pins the old broker's CA and must be replaced
with the new one, and the proxy has to be re-enrolled before the
bridgehead connects again.
Manoj Waikar