volker.raschekandCopilot
ad7b76852b
Issuing an intermediate certificate authority or a client certificate always signs against the private key of the parent authority, regardless of whether that authority is managed in the same run. With `certificate_authority_root_ca_skip` or `certificate_authority_intermediate_ca_skip` enabled and no previously provisioned key at the configured path, this surfaced as a generic module error deep inside the signing task. Stat the parent private key upfront and assert its presence, so the failure names the missing path and the variables that control it. Skipping the parent remains valid when its key already exists, because the check inspects the file instead of the skip variable. Co-authored-by: Copilot <copilot@github.com>