v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

Breaking change release. Plaintext HTTP listener removed. The certctl control plane now terminates TLS 1.3 on :8443 via http.Server.ListenAndServeTLS. No CERTCTL_TLS_ENABLED=false escape hatch. No dual-listener mode. One-step cutover per docs/upgrade-to-tls.md. Server - cmd/server/tls.go: certHolder with SIGHUP hot-reload + atomic cert swap, buildServerTLSConfig (TLS 1.3 min, GetCertificate callback), preflightServerTLS validation - cmd/server/main.go: ListenAndServeTLS in place of ListenAndServe, watchSIGHUP wiring, cert/key path config threading - tls_test.go: 418-line regression coverage of reload, preflight, callback behavior, SAN validation Config - CERTCTL_TLS_CERT_PATH / CERTCTL_TLS_KEY_PATH (required) - Plaintext rejection: agents/CLI/MCP pre-flight-fail on http:// URLs with a pointer to docs/upgrade-to-tls.md Agents, CLI, MCP - All three pre-flight-reject http:// URLs with fail-loud diagnostic - CERTCTL_SERVER_CA_BUNDLE_PATH for private-CA trust - CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY for dev-only bypass (loud warning on startup) - install-agent.sh emits both vars as commented template lines docker-compose - certctl-tls-init sidecar generates SAN-valid self-signed cert into deploy/test/certs/ on first boot - All demo-stack curls pin against ca.crt with --cacert Helm chart - Three TLS provisioning modes, exactly one required: - server.tls.existingSecret (operator-supplied) - server.tls.certManager.enabled (cert-manager integration) - server.tls.selfSigned.enabled (eval only — not for production) - server-certificate.yaml template for cert-manager mode - helm install without a TLS source fails at template render with a pointer to docs/tls.md CI - .github/workflows/ci.yml Helm Chart Validation step renders the chart in both existingSecret and cert-manager modes, plus an inverse guard-regression test that asserts helm template MUST refuse to render when no TLS source is configured. Previously the single `helm template` invocation hit the certctl.tls.required fail-loud guard and exit-1'd CI. Four invocations now: lint (existingSecret), template (existingSecret), template (cert-manager), template (no args — must fail). Integration tests - deploy/test/integration_test.go stands up the Compose stack over HTTPS, extracts the CA bundle, and exercises every certctl API over https://localhost:8443 - All 34 integration subtests green (per Phase 8 local CI-parity) Documentation - New: docs/tls.md (provisioning patterns, rotation, SIGHUP reload) - New: docs/upgrade-to-tls.md (one-step cutover, no-downgrade warnings, fleet-roll sequencing) - CHANGELOG.md: v2.2.0 "HTTPS Everywhere — The Irony" entry (file heading unchanged; release tag is v2.0.47) - All curls in docs/, examples/, deploy/helm/ guides use https://localhost:8443 --cacert Verification - grep -rn "ListenAndServe[^T]" cmd/ internal/ → 0 hits - grep -rn "\"http://" cmd/ internal/ → 2 benign hits (Caddy admin API default, SSRF doc comment) — zero certctl endpoints - Tasks #197–#206 (Phases 0–8) all closed in the tracker Files: 65 changed, 3489 insertions, 372 deletions (pre-CI-fix).
2026-06-07 13:51:36 +00:00 · 2026-04-20 03:31:05 +00:00
parent 04c7eca615
commit 52248be717
66 changed files with 3518 additions and 375 deletions
@@ -7,6 +7,7 @@ import (
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
+	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/json"
@@ -72,7 +73,7 @@ func TestAgent_Heartbeat_Success(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Should not panic
 	agent.sendHeartbeat(context.Background())
@@ -93,7 +94,7 @@ func TestAgent_Heartbeat_ServerError(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Should increment consecutive failures
 	failureBefore := agent.consecutiveFailures
@@ -115,7 +116,7 @@ func TestAgent_Heartbeat_ConnectionError(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Should fail due to connection error
 	agent.sendHeartbeat(context.Background())
@@ -150,7 +151,7 @@ func TestAgent_PollWork_NoWork(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Should not panic
 	agent.pollForWork(context.Background())
@@ -195,7 +196,7 @@ func TestAgent_PollWork_Success(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Should not panic; work items are processed in separate gorines in real usage
 	agent.pollForWork(context.Background())
@@ -285,7 +286,7 @@ func TestParsePEMFile(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Parse the file
 	entries := agent.parsePEMFile(certPath)
@@ -336,7 +337,7 @@ func TestParsePEMFile_MultipleCerts(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	entries := agent.parsePEMFile(certPath)

@@ -362,7 +363,7 @@ func TestParseDERFile(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	entry, err := agent.parseDERFile(derPath)
 	if err != nil {
@@ -397,7 +398,7 @@ func TestParseDERFile_Invalid(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	_, err := agent.parseDERFile(derPath)
 	if err == nil {
@@ -439,7 +440,7 @@ func TestScanDirectory(t *testing.T) {
 		DiscoveryDirs: []string{tmpdir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Simulate directory walk manually (as runDiscoveryScan does)
 	var certs []discoveredCertEntry
@@ -474,7 +475,7 @@ func TestCreateTargetConnector_NGINX(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	configJSON := json.RawMessage(`{"cert_path":"/etc/nginx/cert.pem"}`)
 	connector, err := agent.createTargetConnector("NGINX", configJSON)
@@ -496,7 +497,7 @@ func TestCreateTargetConnector_Unsupported(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	_, err := agent.createTargetConnector("UnsupportedType", nil)

@@ -530,7 +531,7 @@ func TestFetchCertificate_Success(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	certPEM, err := agent.fetchCertificate(context.Background(), "mc-001")
 	if err != nil {
@@ -556,7 +557,7 @@ func TestFetchCertificate_NotFound(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	_, err := agent.fetchCertificate(context.Background(), "mc-nonexistent")
 	if err == nil {
@@ -592,7 +593,7 @@ func TestReportJobStatus_Success(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	err := agent.reportJobStatus(context.Background(), "j-001", "Completed", "")
 	if err != nil {
@@ -624,7 +625,7 @@ func TestReportJobStatus_WithError(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	err := agent.reportJobStatus(context.Background(), "j-001", "Failed", "deployment failed")
 	if err != nil {
@@ -658,7 +659,7 @@ func TestMakeRequest_Success(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	resp, err := agent.makeRequest(context.Background(), http.MethodPost, "/test", map[string]string{"key": "value"})
 	if err != nil {
@@ -680,7 +681,7 @@ func TestMakeRequest_InvalidURL(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	_, err := agent.makeRequest(context.Background(), http.MethodGet, "/test", nil)
 	if err == nil {
@@ -765,7 +766,7 @@ func TestNewAgent(t *testing.T) {
 	}

 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	if agent.config != cfg {
 		t.Error("config not set correctly")
@@ -791,7 +792,7 @@ func TestNewAgent_WithLogger(t *testing.T) {
 		Hostname:  "test-host",
 	}

-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	if agent.logger != logger {
 		t.Error("logger not set correctly")
@@ -954,7 +955,7 @@ func TestCreateTargetConnector_AllSupportedTypes(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1007,7 +1008,7 @@ func TestCreateTargetConnector_InvalidJSON(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	invalidJSON := json.RawMessage("{invalid json}")

@@ -1031,7 +1032,7 @@ func TestCreateTargetConnector_UnknownType(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	_, err := agent.createTargetConnector("MagicBox", nil)

@@ -1061,7 +1062,7 @@ func TestCreateTargetConnector_EmptyConfig(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	for _, typeName := range tests {
 		t.Run(typeName, func(t *testing.T) {
@@ -1137,7 +1138,7 @@ func TestRunDiscoveryScan_ValidCerts(t *testing.T) {
 		DiscoveryDirs: []string{tmpDir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Run discovery scan
 	agent.runDiscoveryScan(context.Background())
@@ -1165,7 +1166,7 @@ func TestRunDiscoveryScan_NoCertificates(t *testing.T) {
 		DiscoveryDirs: []string{tmpDir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Run discovery scan - should complete without error even with empty directory
 	agent.runDiscoveryScan(context.Background())
@@ -1222,7 +1223,7 @@ func TestRunDiscoveryScan_MultipleCerts(t *testing.T) {
 		DiscoveryDirs: []string{tmpDir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Run discovery scan
 	agent.runDiscoveryScan(context.Background())
@@ -1273,7 +1274,7 @@ func TestRunDiscoveryScan_DERCertificate(t *testing.T) {
 		DiscoveryDirs: []string{tmpDir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Run discovery scan
 	agent.runDiscoveryScan(context.Background())
@@ -1331,7 +1332,7 @@ func TestRunDiscoveryScan_Subdirectories(t *testing.T) {
 		DiscoveryDirs: []string{tmpDir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Run discovery scan - should recursively find certs in subdirs
 	agent.runDiscoveryScan(context.Background())
@@ -1369,7 +1370,7 @@ func TestRunDiscoveryScan_ServerError(t *testing.T) {
 		DiscoveryDirs: []string{tmpDir},
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	// Should handle server error gracefully without panicking
 	agent.runDiscoveryScan(context.Background())
@@ -1396,7 +1397,7 @@ func TestDiscoveredCertEntry_ValidFields(t *testing.T) {
 		Hostname:  "test-host",
 	}
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	agent := NewAgent(cfg, logger)
+	agent, _ := NewAgent(cfg, logger)

 	entries := agent.parsePEMFile(certPath)

@@ -1447,3 +1448,244 @@ func TestDiscoveredCertEntry_ValidFields(t *testing.T) {
 		t.Error("PEMData should not be empty")
 	}
 }
+
+// ---------------------------------------------------------------------------
+// HTTPS-Everywhere milestone (v2.2, §3.2 / §7) — Phase 5 client-side tests.
+//
+// These tests pin the agent's pre-flight HTTPS-scheme guard and the TLS
+// configuration surface (CA bundle loading + TLS 1.3 round-trip) so that
+// regressions surface at unit-test time, not at the first heartbeat of a
+// production rollout. Matches the same contract asserted by the sibling
+// binaries cmd/cli/main_test.go and cmd/mcp-server/main_test.go — the three
+// must stay in lock-step because all three are HTTPS-only clients of the
+// same control plane.
+// ---------------------------------------------------------------------------
+
+// TestValidateHTTPSScheme pins the pre-flight URL-scheme guard that the
+// HTTPS-Everywhere milestone requires on the agent binary startup path. The
+// agent's diagnostic is distinct from the CLI/MCP variants because it names
+// CERTCTL_SERVER_URL (the only input channel — no --server flag on the
+// agent). Every case here mirrors the dispatch arms in cmd/agent/main.go:
+// validateHTTPSScheme; drifting the error-message substrings is what this
+// test is here to catch.
+func TestValidateHTTPSScheme(t *testing.T) {
+	tests := []struct {
+		name       string
+		serverURL  string
+		wantErr    bool
+		wantErrSub string
+	}{
+		{
+			name:      "https URL passes",
+			serverURL: "https://certctl-server:8443",
+			wantErr:   false,
+		},
+		{
+			name:      "https URL with path passes",
+			serverURL: "https://certctl.example.com/api/v1",
+			wantErr:   false,
+		},
+		{
+			name:      "uppercase HTTPS scheme passes (url.Parse lowercases)",
+			serverURL: "HTTPS://certctl-server:8443",
+			wantErr:   false,
+		},
+		{
+			name:       "empty URL rejected names CERTCTL_SERVER_URL",
+			serverURL:  "",
+			wantErr:    true,
+			wantErrSub: "CERTCTL_SERVER_URL is empty",
+		},
+		{
+			name:       "plaintext http rejected",
+			serverURL:  "http://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "plaintext http://",
+		},
+		{
+			name:       "bare host missing scheme falls through to unsupported",
+			serverURL:  "localhost:8443",
+			wantErr:    true,
+			// url.Parse treats "localhost:8443" as scheme=localhost,
+			// opaque=8443 — exercises the default arm (unsupported scheme)
+			// rather than the empty-scheme arm. Both are fail-closed, which
+			// is what we care about.
+			wantErrSub: "unsupported scheme",
+		},
+		{
+			name:       "path-only URL rejected",
+			serverURL:  "//certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "missing a scheme",
+		},
+		{
+			name:       "unsupported scheme rejected",
+			serverURL:  "ftp://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "unsupported scheme",
+		},
+		{
+			name:       "ws scheme rejected",
+			serverURL:  "ws://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "unsupported scheme",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateHTTPSScheme(tt.serverURL)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("validateHTTPSScheme(%q) err=%v wantErr=%v", tt.serverURL, err, tt.wantErr)
+			}
+			if tt.wantErr && tt.wantErrSub != "" && !strings.Contains(err.Error(), tt.wantErrSub) {
+				t.Errorf("validateHTTPSScheme(%q) err=%q must contain %q so operators see the right diagnostic",
+					tt.serverURL, err.Error(), tt.wantErrSub)
+			}
+		})
+	}
+}
+
+// writeTestCABundle PEM-encodes a cert's DER bytes and writes the result to a
+// tmp file inside dir. Used by CA-bundle tests so each case owns a distinct
+// file path (matters for the "missing file" case which must point at a path
+// that provably does not exist). Returns the path.
+func writeTestCABundle(t *testing.T, dir string, certDER []byte, filename string) string {
+	t.Helper()
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	path := filepath.Join(dir, filename)
+	if err := os.WriteFile(path, pemBytes, 0644); err != nil {
+		t.Fatalf("writing CA bundle %q: %v", path, err)
+	}
+	return path
+}
+
+// TestNewAgent_CABundle_Success confirms that a well-formed PEM bundle gets
+// parsed into an x509.CertPool and wired onto the agent's HTTP client
+// transport. This is the happy path the docs/tls.md "Private CA signed
+// server cert" section depends on.
+func TestNewAgent_CABundle_Success(t *testing.T) {
+	cert, err := generateTestCertWithCN("test.certctl.local")
+	if err != nil {
+		t.Fatalf("generateTestCertWithCN: %v", err)
+	}
+	bundlePath := writeTestCABundle(t, t.TempDir(), cert.Raw, "ca-bundle.pem")
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	agent, err := NewAgent(&AgentConfig{
+		ServerURL:    "https://certctl-server:8443",
+		APIKey:       "test-key",
+		AgentID:      "a-test",
+		Hostname:     "test-host",
+		CABundlePath: bundlePath,
+	}, logger)
+	if err != nil {
+		t.Fatalf("NewAgent with valid CA bundle err=%v want nil", err)
+	}
+
+	transport, ok := agent.client.Transport.(*http.Transport)
+	if !ok {
+		t.Fatalf("agent.client.Transport is %T; want *http.Transport", agent.client.Transport)
+	}
+	if transport.TLSClientConfig == nil {
+		t.Fatal("TLSClientConfig is nil; HTTPS-everywhere milestone requires a non-nil TLS config")
+	}
+	if transport.TLSClientConfig.MinVersion != tls.VersionTLS13 {
+		t.Errorf("MinVersion=%x want TLS 1.3 (%x) per §2.3 of the milestone spec",
+			transport.TLSClientConfig.MinVersion, tls.VersionTLS13)
+	}
+	if transport.TLSClientConfig.RootCAs == nil {
+		t.Error("RootCAs is nil; the configured CA bundle was silently dropped")
+	}
+}
+
+// TestNewAgent_CABundle_MissingFile pins the fail-loud behavior when the
+// operator points CERTCTL_SERVER_CA_BUNDLE_PATH at a path that does not
+// exist. Falling back to system roots here would mask a misconfiguration as
+// a much harder-to-debug TLS handshake failure downstream.
+func TestNewAgent_CABundle_MissingFile(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	missingPath := filepath.Join(t.TempDir(), "does-not-exist.pem")
+	_, err := NewAgent(&AgentConfig{
+		ServerURL:    "https://certctl-server:8443",
+		APIKey:       "test-key",
+		AgentID:      "a-test",
+		Hostname:     "test-host",
+		CABundlePath: missingPath,
+	}, logger)
+	if err == nil {
+		t.Fatal("NewAgent err=nil for missing CA bundle path; must fail loud at startup")
+	}
+	if !strings.Contains(err.Error(), "reading CA bundle") {
+		t.Errorf("err=%q must contain \"reading CA bundle\" so operators can trace the cause", err.Error())
+	}
+}
+
+// TestNewAgent_CABundle_EmptyPEM covers the "file exists but contains no
+// valid certs" case (garbage, wrong-format, stripped PEM). AppendCertsFromPEM
+// returns false in this case; NewAgent must translate that into a fail-loud
+// startup error rather than quietly carry on with an empty pool.
+func TestNewAgent_CABundle_EmptyPEM(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	bundlePath := filepath.Join(t.TempDir(), "empty.pem")
+	if err := os.WriteFile(bundlePath, []byte("not a pem-encoded certificate, just garbage\n"), 0644); err != nil {
+		t.Fatalf("writing garbage bundle: %v", err)
+	}
+	_, err := NewAgent(&AgentConfig{
+		ServerURL:    "https://certctl-server:8443",
+		APIKey:       "test-key",
+		AgentID:      "a-test",
+		Hostname:     "test-host",
+		CABundlePath: bundlePath,
+	}, logger)
+	if err == nil {
+		t.Fatal("NewAgent err=nil for empty-PEM CA bundle; must fail loud at startup")
+	}
+	if !strings.Contains(err.Error(), "no valid PEM-encoded certificates") {
+		t.Errorf("err=%q must contain \"no valid PEM-encoded certificates\" so operators see why the bundle was rejected", err.Error())
+	}
+}
+
+// TestNewAgent_TLSRoundTrip is the end-to-end integration-style check: spin
+// up an httptest.NewTLSServer (which presents a self-signed cert over TLS
+// 1.3), feed that cert into the agent as a CA bundle, and confirm the agent
+// successfully completes a heartbeat round-trip over HTTPS. This proves that
+// (a) the CA pool is actually being consulted during verification and (b)
+// the TLS 1.3 MinVersion doesn't break against httptest's default
+// negotiation. Equivalent to the "TLS handshake succeeds against a
+// self-signed control plane" integration gate, but runs in-process with no
+// Docker dependency.
+func TestNewAgent_TLSRoundTrip(t *testing.T) {
+	var heartbeatHit int
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/v1/agents/a-tls-test/heartbeat" && r.Method == http.MethodPost {
+			heartbeatHit++
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	// server.Certificate() returns the *x509.Certificate httptest presents;
+	// PEM-encode its DER bytes so NewAgent's AppendCertsFromPEM can ingest it.
+	bundlePath := writeTestCABundle(t, t.TempDir(), server.Certificate().Raw, "httptest-ca.pem")
+
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	agent, err := NewAgent(&AgentConfig{
+		ServerURL:    server.URL,
+		APIKey:       "test-key",
+		AgentID:      "a-tls-test",
+		Hostname:     "tls-test-host",
+		CABundlePath: bundlePath,
+	}, logger)
+	if err != nil {
+		t.Fatalf("NewAgent with httptest CA bundle err=%v want nil", err)
+	}
+
+	agent.sendHeartbeat(context.Background())
+
+	if heartbeatHit != 1 {
+		t.Fatalf("heartbeat handler hit %d times; want 1 — the TLS round-trip must actually complete", heartbeatHit)
+	}
+}
@@ -8,6 +8,7 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha256"
+	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/json"
@@ -19,6 +20,7 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -46,13 +48,15 @@ import (

 // AgentConfig represents the agent-side configuration.
 type AgentConfig struct {
-	ServerURL     string   // Control plane server URL (e.g., http://localhost:8443)
-	APIKey        string   // Agent API key for authentication
-	AgentName     string   // Agent name for identification
-	AgentID       string   // Agent ID for API calls (set after registration or from env)
-	Hostname      string   // Server hostname
-	KeyDir        string   // Directory for storing private keys (default: /var/lib/certctl/keys)
-	DiscoveryDirs []string // Directories to scan for certificates (comma-separated via env)
+	ServerURL          string   // Control plane server URL (e.g., https://localhost:8443) — must be https:// scheme
+	APIKey             string   // Agent API key for authentication
+	AgentName          string   // Agent name for identification
+	AgentID            string   // Agent ID for API calls (set after registration or from env)
+	Hostname           string   // Server hostname
+	KeyDir             string   // Directory for storing private keys (default: /var/lib/certctl/keys)
+	DiscoveryDirs      []string // Directories to scan for certificates (comma-separated via env)
+	CABundlePath       string   // Optional path to a PEM-encoded CA bundle that signed the server's cert (empty = system roots)
+	InsecureSkipVerify bool     // Dev-only: skip TLS certificate verification. Never enable in production. See docs/tls.md.
 }

 // ErrAgentRetired is the sentinel returned by [Agent.Run] when the control
@@ -113,16 +117,57 @@ type JobItem struct {
 }

 // NewAgent creates a new agent instance.
-func NewAgent(cfg *AgentConfig, logger *slog.Logger) *Agent {
+//
+// The returned HTTP client enforces HTTPS-only control-plane access per the
+// HTTPS-Everywhere milestone (see docs/tls.md). TLS 1.3 is required; the
+// optional CABundlePath loads a PEM bundle into RootCAs so the agent can
+// trust internal / self-signed server certs without touching system trust
+// stores. InsecureSkipVerify is a dev-only escape hatch — callers must log a
+// loud warning when it's set; never enable in production (see §2.4 of the
+// milestone spec and docs/upgrade-to-tls.md).
+//
+// Returns an error if CABundlePath is set but unreadable or malformed — fail
+// loud at startup rather than silently fall back to system roots, which would
+// turn a misconfigured bundle path into a cryptic "x509: certificate signed
+// by unknown authority" on the first heartbeat.
+func NewAgent(cfg *AgentConfig, logger *slog.Logger) (*Agent, error) {
+	tlsConfig := &tls.Config{
+		MinVersion:         tls.VersionTLS13,
+		InsecureSkipVerify: cfg.InsecureSkipVerify, //nolint:gosec // opt-in dev escape hatch, documented in docs/tls.md
+	}
+	if cfg.CABundlePath != "" {
+		pemBytes, err := os.ReadFile(cfg.CABundlePath)
+		if err != nil {
+			return nil, fmt.Errorf("reading CA bundle at %q: %w", cfg.CABundlePath, err)
+		}
+		pool := x509.NewCertPool()
+		if !pool.AppendCertsFromPEM(pemBytes) {
+			return nil, fmt.Errorf("CA bundle at %q contains no valid PEM-encoded certificates", cfg.CABundlePath)
+		}
+		tlsConfig.RootCAs = pool
+	}
+
+	httpClient := &http.Client{
+		Timeout: 30 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig:       tlsConfig,
+			ForceAttemptHTTP2:     true,
+			MaxIdleConns:          10,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+		},
+	}
+
 	return &Agent{
 		config:            cfg,
 		logger:            logger,
-		client:            &http.Client{Timeout: 30 * time.Second},
+		client:            httpClient,
 		heartbeatInterval: 60 * time.Second,
 		pollInterval:      30 * time.Second,
 		discoveryInterval: 6 * time.Hour, // scan for certs every 6 hours
 		retiredSignal:     make(chan struct{}),
-	}
+	}, nil
 }

 // markRetired records that the control plane has declared this agent retired
@@ -1118,12 +1163,14 @@ func certKeyInfo(cert *x509.Certificate) (string, int) {

 func main() {
 	// Parse command-line flags (with env var fallbacks for Docker deployment)
-	serverURL := flag.String("server", getEnvDefault("CERTCTL_SERVER_URL", "http://localhost:8443"), "Control plane server URL")
+	serverURL := flag.String("server", getEnvDefault("CERTCTL_SERVER_URL", "https://localhost:8443"), "Control plane server URL (must be https://)")
 	apiKey := flag.String("api-key", getEnvDefault("CERTCTL_API_KEY", ""), "Agent API key")
 	agentName := flag.String("name", getEnvDefault("CERTCTL_AGENT_NAME", "certctl-agent"), "Agent name")
 	agentID := flag.String("agent-id", getEnvDefault("CERTCTL_AGENT_ID", ""), "Agent ID (from registration)")
 	keyDir := flag.String("key-dir", getEnvDefault("CERTCTL_KEY_DIR", "/var/lib/certctl/keys"), "Directory for storing private keys")
 	discoveryDirsStr := flag.String("discovery-dirs", getEnvDefault("CERTCTL_DISCOVERY_DIRS", ""), "Comma-separated directories to scan for certificates")
+	caBundlePath := flag.String("ca-bundle", getEnvDefault("CERTCTL_SERVER_CA_BUNDLE_PATH", ""), "Path to a PEM-encoded CA bundle that signed the server's TLS cert (optional; falls back to system roots)")
+	insecureSkipVerify := flag.Bool("insecure-skip-verify", getEnvBoolDefault("CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY", false), "Dev-only: skip TLS certificate verification. Never enable in production. See docs/tls.md.")
 	flag.Parse()

 	if *apiKey == "" {
@@ -1137,6 +1184,18 @@ func main() {
 		os.Exit(1)
 	}

+	// Pre-flight URL-scheme validation — reject plaintext http:// before any
+	// network call. The HTTPS-Everywhere milestone (§2.4, §7) mandates that
+	// mis-configured agents fail loudly at startup with a diagnostic pointing
+	// at the upgrade guide, rather than producing a TCP-refused or
+	// TLS-handshake-error that obscures the actual cause.
+	if err := validateHTTPSScheme(*serverURL); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		fmt.Fprintf(os.Stderr, "\nThe certctl control plane is HTTPS-only as of v2.2.\n")
+		fmt.Fprintf(os.Stderr, "See docs/upgrade-to-tls.md for the cutover walkthrough.\n")
+		os.Exit(1)
+	}
+
 	// Set up structured logging
 	logLevel := slog.LevelInfo
 	if getEnvDefault("CERTCTL_LOG_LEVEL", "info") == "debug" {
@@ -1165,17 +1224,27 @@ func main() {

 	// Create agent configuration
 	agentCfg := &AgentConfig{
-		ServerURL:     *serverURL,
-		APIKey:        *apiKey,
-		AgentName:     *agentName,
-		AgentID:       *agentID,
-		Hostname:      hostname,
-		KeyDir:        *keyDir,
-		DiscoveryDirs: discoveryDirs,
+		ServerURL:          *serverURL,
+		APIKey:             *apiKey,
+		AgentName:          *agentName,
+		AgentID:            *agentID,
+		Hostname:           hostname,
+		KeyDir:             *keyDir,
+		DiscoveryDirs:      discoveryDirs,
+		CABundlePath:       *caBundlePath,
+		InsecureSkipVerify: *insecureSkipVerify,
+	}
+
+	if agentCfg.InsecureSkipVerify {
+		logger.Warn("TLS certificate verification is disabled (CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY=true) — never enable this in production")
 	}

 	// Create and start agent
-	agent := NewAgent(agentCfg, logger)
+	agent, err := NewAgent(agentCfg, logger)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: failed to initialize agent: %v\n", err)
+		os.Exit(1)
+	}

 	// Create context with cancellation for graceful shutdown
 	ctx, cancel := context.WithCancel(context.Background())
@@ -1233,3 +1302,49 @@ func getEnvDefault(key, defaultValue string) string {
 	}
 	return defaultValue
 }
+
+// getEnvBoolDefault parses an environment variable as a boolean. Accepts "1",
+// "t", "true", "T", "TRUE", "True" as true; anything else (including empty)
+// returns the provided default. Kept permissive on purpose so operators can
+// flip the dev-only TLS skip-verify toggle with any common truthy spelling
+// without having to remember exactly what we parse.
+func getEnvBoolDefault(key string, defaultValue bool) bool {
+	raw := os.Getenv(key)
+	if raw == "" {
+		return defaultValue
+	}
+	switch strings.ToLower(strings.TrimSpace(raw)) {
+	case "1", "t", "true", "yes", "on":
+		return true
+	case "0", "f", "false", "no", "off":
+		return false
+	default:
+		return defaultValue
+	}
+}
+
+// validateHTTPSScheme enforces the HTTPS-Everywhere milestone's §7 acceptance
+// criterion: "Agent with CERTCTL_SERVER_URL=http://... fails at startup with
+// a fail-loud diagnostic pointing at docs/upgrade-to-tls.md. Not TCP-refused,
+// not TLS-handshake-error — a pre-flight config validation failure before any
+// network call." Returns a descriptive error; the caller prints the upgrade
+// guide pointer and exits non-zero.
+func validateHTTPSScheme(serverURL string) error {
+	if serverURL == "" {
+		return fmt.Errorf("CERTCTL_SERVER_URL is empty — set it to an https:// URL (e.g., https://certctl-server:8443)")
+	}
+	u, err := url.Parse(serverURL)
+	if err != nil {
+		return fmt.Errorf("CERTCTL_SERVER_URL %q is not a valid URL: %w", serverURL, err)
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "https":
+		return nil
+	case "http":
+		return fmt.Errorf("CERTCTL_SERVER_URL %q uses plaintext http:// — the certctl control plane is HTTPS-only", serverURL)
+	case "":
+		return fmt.Errorf("CERTCTL_SERVER_URL %q is missing a scheme — expected https://", serverURL)
+	default:
+		return fmt.Errorf("CERTCTL_SERVER_URL %q uses unsupported scheme %q — expected https://", serverURL, u.Scheme)
+	}
+}
@@ -228,7 +228,7 @@ func TestReportVerificationResult_Success(t *testing.T) {
 		ServerURL: server.URL,
 		APIKey:    "test-api-key",
 	}
-	agent := NewAgent(cfg, nil)
+	agent, _ := NewAgent(cfg, nil)

 	result := &VerificationResult{
 		ExpectedFingerprint: "abc123",
@@ -244,7 +244,7 @@ func TestReportVerificationResult_Success(t *testing.T) {
 }

 func TestReportVerificationResult_MissingFields(t *testing.T) {
-	agent := NewAgent(&AgentConfig{}, nil)
+	agent, _ := NewAgent(&AgentConfig{}, nil)

 	result := &VerificationResult{
 		Verified:   true,
@@ -343,7 +343,7 @@ func TestReportVerificationResult_ServerError(t *testing.T) {
 		ServerURL: server.URL,
 		APIKey:    "test-api-key",
 	}
-	agent := NewAgent(cfg, nil)
+	agent, _ := NewAgent(cfg, nil)

 	result := &VerificationResult{
 		ExpectedFingerprint: "abc123",
@@ -3,7 +3,9 @@ package main
 import (
 	"flag"
 	"fmt"
+	"net/url"
 	"os"
+	"strings"

 	"github.com/shankar0123/certctl/internal/cli"
 )
@@ -43,22 +45,34 @@ Commands:
  version          Show CLI version

 Examples:
-  certctl-cli --server http://localhost:8443 --api-key mykey certs list
+  certctl-cli --server https://localhost:8443 --api-key mykey certs list
  certctl-cli certs renew mc-prod --format json
  certctl-cli import certs.pem
 `)
 	}

-	serverURL := fs.String("server", os.Getenv("CERTCTL_SERVER_URL"), "certctl server URL (env: CERTCTL_SERVER_URL)")
-	if *serverURL == "" {
-		*serverURL = "http://localhost:8443"
+	// HTTPS-Everywhere (v2.2): the server is HTTPS-only. The default URL uses
+	// https://; plaintext http:// is rejected by validateHTTPSScheme below.
+	defaultServer := os.Getenv("CERTCTL_SERVER_URL")
+	if defaultServer == "" {
+		defaultServer = "https://localhost:8443"
 	}
+	serverURL := fs.String("server", defaultServer, "certctl server URL — must be https:// (env: CERTCTL_SERVER_URL)")

 	apiKey := fs.String("api-key", os.Getenv("CERTCTL_API_KEY"), "API key for authentication (env: CERTCTL_API_KEY)")
 	format := fs.String("format", "table", "Output format: table, json")
+	caBundlePath := fs.String("ca-bundle", os.Getenv("CERTCTL_SERVER_CA_BUNDLE_PATH"), "Path to a PEM-encoded CA bundle that signed the server cert (env: CERTCTL_SERVER_CA_BUNDLE_PATH)")
+	insecure := fs.Bool("insecure", strings.EqualFold(os.Getenv("CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY"), "true"), "Skip TLS certificate verification — dev only, never set in production (env: CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY)")

 	fs.Parse(os.Args[1:])

+	if err := validateHTTPSScheme(*serverURL); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		fmt.Fprintf(os.Stderr, "\nThe certctl control plane is HTTPS-only as of v2.2.\n")
+		fmt.Fprintf(os.Stderr, "See docs/upgrade-to-tls.md for the cutover walkthrough.\n")
+		os.Exit(1)
+	}
+
 	args := fs.Args()
 	if len(args) == 0 {
 		fs.Usage()
@@ -66,13 +80,16 @@ Examples:
 	}

 	// Create client
-	client := cli.NewClient(*serverURL, *apiKey, *format)
+	client, err := cli.NewClient(*serverURL, *apiKey, *format, *caBundlePath, *insecure)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}

 	// Dispatch to appropriate command
 	command := args[0]
 	cmdArgs := args[1:]

-	var err error
 	switch command {
 	case "certs":
 		err = handleCerts(client, cmdArgs)
@@ -237,3 +254,26 @@ func handleImport(client *cli.Client, args []string) error {
 func handleStatus(client *cli.Client) error {
 	return client.GetStatus()
 }
+
+// validateHTTPSScheme rejects plaintext and empty-scheme server URLs at
+// startup so operators get a fail-loud diagnostic before any network call,
+// not a TCP-refused or TLS-handshake-error downstream. See docs/upgrade-to-tls.md.
+func validateHTTPSScheme(serverURL string) error {
+	if serverURL == "" {
+		return fmt.Errorf("server URL is empty — set --server (or CERTCTL_SERVER_URL) to an https:// URL (e.g., https://certctl-server:8443)")
+	}
+	u, err := url.Parse(serverURL)
+	if err != nil {
+		return fmt.Errorf("server URL %q is not a valid URL: %w", serverURL, err)
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "https":
+		return nil
+	case "http":
+		return fmt.Errorf("server URL %q uses plaintext http:// — the certctl control plane is HTTPS-only", serverURL)
+	case "":
+		return fmt.Errorf("server URL %q is missing a scheme — expected https://", serverURL)
+	default:
+		return fmt.Errorf("server URL %q uses unsupported scheme %q — expected https://", serverURL, u.Scheme)
+	}
+}
@@ -0,0 +1,96 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestValidateHTTPSScheme pins the pre-flight URL-scheme guard that the
+// HTTPS-Everywhere milestone (v2.2, §3.2) requires on the certctl-cli binary
+// startup path. The CLI's diagnostic is distinct from the agent and MCP server
+// because it surfaces the --server flag alongside CERTCTL_SERVER_URL — so the
+// empty-URL case pins that flag-name substring separately. Every other case
+// mirrors the dispatch arms in cmd/cli/main.go:validateHTTPSScheme; drifting
+// the substrings is what this test is here to catch.
+func TestValidateHTTPSScheme(t *testing.T) {
+	tests := []struct {
+		name       string
+		serverURL  string
+		wantErr    bool
+		wantErrSub string // substring that MUST appear in the error message
+	}{
+		{
+			name:      "https URL passes",
+			serverURL: "https://certctl-server:8443",
+			wantErr:   false,
+		},
+		{
+			name:      "https URL with path passes",
+			serverURL: "https://certctl.example.com/api/v1",
+			wantErr:   false,
+		},
+		{
+			name:      "uppercase HTTPS scheme passes (url.Parse lowercases)",
+			serverURL: "HTTPS://certctl-server:8443",
+			wantErr:   false,
+		},
+		{
+			name:       "empty URL rejected mentions --server flag",
+			serverURL:  "",
+			wantErr:    true,
+			wantErrSub: "--server",
+		},
+		{
+			name:       "empty URL rejected also mentions CERTCTL_SERVER_URL",
+			serverURL:  "",
+			wantErr:    true,
+			wantErrSub: "CERTCTL_SERVER_URL",
+		},
+		{
+			name:       "plaintext http rejected",
+			serverURL:  "http://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "plaintext http://",
+		},
+		{
+			name:       "bare host missing scheme rejected",
+			serverURL:  "localhost:8443",
+			wantErr:    true,
+			// url.Parse treats "localhost:8443" as scheme=localhost, opaque=8443
+			// — exercises the default arm (unsupported scheme) rather than the
+			// empty-scheme arm. Both are fail-closed, which is what we care about.
+			wantErrSub: "unsupported scheme",
+		},
+		{
+			name:       "path-only URL rejected",
+			serverURL:  "//certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "missing a scheme",
+		},
+		{
+			name:       "unsupported scheme rejected",
+			serverURL:  "ftp://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "unsupported scheme",
+		},
+		{
+			name:       "ws scheme rejected",
+			serverURL:  "ws://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "unsupported scheme",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateHTTPSScheme(tt.serverURL)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("validateHTTPSScheme(%q) err=%v wantErr=%v", tt.serverURL, err, tt.wantErr)
+			}
+			if tt.wantErr && tt.wantErrSub != "" && !strings.Contains(err.Error(), tt.wantErrSub) {
+				t.Errorf("validateHTTPSScheme(%q) err=%q must contain %q so operators see the right diagnostic",
+					tt.serverURL, err.Error(), tt.wantErrSub)
+			}
+		})
+	}
+}
@@ -4,8 +4,10 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"net/url"
 	"os"
 	"os/signal"
+	"strings"

 	gomcp "github.com/modelcontextprotocol/go-sdk/mcp"

@@ -16,14 +18,33 @@ import (
 var Version = "dev"

 func main() {
+	// HTTPS-Everywhere (v2.2): the server is HTTPS-only. The default URL
+	// uses https://; plaintext http:// is rejected by validateHTTPSScheme
+	// below with a fail-loud pre-flight diagnostic pointing at
+	// docs/upgrade-to-tls.md, so operators never get a TCP-refused or
+	// TLS-handshake-error downstream. See docs/tls.md for CA bundle and
+	// insecure-skip-verify guidance.
 	serverURL := os.Getenv("CERTCTL_SERVER_URL")
 	if serverURL == "" {
-		serverURL = "http://localhost:8443"
+		serverURL = "https://localhost:8443"
+	}
+
+	if err := validateHTTPSScheme(serverURL); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		fmt.Fprintf(os.Stderr, "\nThe certctl control plane is HTTPS-only as of v2.2.\n")
+		fmt.Fprintf(os.Stderr, "See docs/upgrade-to-tls.md for the cutover walkthrough.\n")
+		os.Exit(1)
 	}

 	apiKey := os.Getenv("CERTCTL_API_KEY")
+	caBundlePath := os.Getenv("CERTCTL_SERVER_CA_BUNDLE_PATH")
+	insecure := strings.EqualFold(os.Getenv("CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY"), "true")

-	client := mcp.NewClient(serverURL, apiKey)
+	client, err := mcp.NewClient(serverURL, apiKey, caBundlePath, insecure)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}

 	server := gomcp.NewServer(&gomcp.Implementation{
 		Name:    "certctl",
@@ -41,3 +62,26 @@ func main() {
 		log.Fatalf("MCP server error: %v", err)
 	}
 }
+
+// validateHTTPSScheme rejects plaintext and empty-scheme server URLs at
+// startup so operators get a fail-loud diagnostic before any network call,
+// not a TCP-refused or TLS-handshake-error downstream. See docs/upgrade-to-tls.md.
+func validateHTTPSScheme(serverURL string) error {
+	if serverURL == "" {
+		return fmt.Errorf("server URL is empty — set CERTCTL_SERVER_URL to an https:// URL (e.g., https://certctl-server:8443)")
+	}
+	u, err := url.Parse(serverURL)
+	if err != nil {
+		return fmt.Errorf("server URL %q is not a valid URL: %w", serverURL, err)
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "https":
+		return nil
+	case "http":
+		return fmt.Errorf("server URL %q uses plaintext http:// — the certctl control plane is HTTPS-only", serverURL)
+	case "":
+		return fmt.Errorf("server URL %q is missing a scheme — expected https://", serverURL)
+	default:
+		return fmt.Errorf("server URL %q uses unsupported scheme %q — expected https://", serverURL, u.Scheme)
+	}
+}
@@ -0,0 +1,90 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestValidateHTTPSScheme pins the pre-flight URL-scheme guard that the
+// HTTPS-Everywhere milestone (v2.2, §3.2) requires on the MCP server binary
+// startup path. The whole point is to fail loud with a diagnostic that points
+// at docs/upgrade-to-tls.md *before* any network call — not a cryptic
+// TCP-refused or TLS-handshake-error two ticks later. Every case here mirrors
+// the dispatch arms in cmd/mcp-server/main.go:validateHTTPSScheme; drifting
+// the error-message substrings is what this test is here to catch.
+func TestValidateHTTPSScheme(t *testing.T) {
+	tests := []struct {
+		name       string
+		serverURL  string
+		wantErr    bool
+		wantErrSub string // substring that MUST appear in the error message
+	}{
+		{
+			name:      "https URL passes",
+			serverURL: "https://certctl-server:8443",
+			wantErr:   false,
+		},
+		{
+			name:      "https URL with path passes",
+			serverURL: "https://certctl.example.com/api/v1",
+			wantErr:   false,
+		},
+		{
+			name:      "uppercase HTTPS scheme passes (url.Parse lowercases)",
+			serverURL: "HTTPS://certctl-server:8443",
+			wantErr:   false,
+		},
+		{
+			name:       "empty URL rejected",
+			serverURL:  "",
+			wantErr:    true,
+			wantErrSub: "server URL is empty",
+		},
+		{
+			name:       "plaintext http rejected",
+			serverURL:  "http://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "plaintext http://",
+		},
+		{
+			name:       "bare host missing scheme rejected",
+			serverURL:  "localhost:8443",
+			wantErr:    true,
+			// url.Parse treats "localhost:8443" as scheme=localhost, opaque=8443
+			// — exercises the default arm (unsupported scheme) rather than the
+			// empty-scheme arm. Both are fail-closed, which is what we care about.
+			wantErrSub: "unsupported scheme",
+		},
+		{
+			name:       "path-only URL rejected",
+			serverURL:  "//certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "missing a scheme",
+		},
+		{
+			name:       "unsupported scheme rejected",
+			serverURL:  "ftp://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "unsupported scheme",
+		},
+		{
+			name:       "ws scheme rejected",
+			serverURL:  "ws://certctl-server:8443",
+			wantErr:    true,
+			wantErrSub: "unsupported scheme",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateHTTPSScheme(tt.serverURL)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("validateHTTPSScheme(%q) err=%v wantErr=%v", tt.serverURL, err, tt.wantErr)
+			}
+			if tt.wantErr && tt.wantErrSub != "" && !strings.Contains(err.Error(), tt.wantErrSub) {
+				t.Errorf("validateHTTPSScheme(%q) err=%q must contain %q so operators see the right diagnostic",
+					tt.serverURL, err.Error(), tt.wantErrSub)
+			}
+		})
+	}
+}
@@ -736,22 +736,54 @@ func main() {
 		logger.Info("dashboard directory not found, serving API only")
 	}

+	// HTTPS-everywhere milestone §2.1: fail-loud if the TLS configuration is
+	// missing or malformed. Duplicates config.Validate() for defense in depth
+	// (same pattern as preflightSCEPChallengePassword).
+	if err := preflightServerTLS(cfg.Server.TLS.CertPath, cfg.Server.TLS.KeyPath); err != nil {
+		logger.Error("startup refused: HTTPS cert unusable; control plane is HTTPS-only",
+			"error", err,
+			"cert_path", cfg.Server.TLS.CertPath,
+			"key_path", cfg.Server.TLS.KeyPath)
+		os.Exit(1)
+	}
+
+	// Load the cert+key into a SIGHUP-reloadable holder. Any subsequent
+	// SIGHUP triggers a fresh read and atomic swap so rotations do not need
+	// a restart. Reload failures keep the previous cert and log a warning.
+	tlsCertHolder, err := newCertHolder(cfg.Server.TLS.CertPath, cfg.Server.TLS.KeyPath)
+	if err != nil {
+		logger.Error("startup refused: failed to load TLS cert holder",
+			"error", err,
+			"cert_path", cfg.Server.TLS.CertPath,
+			"key_path", cfg.Server.TLS.KeyPath)
+		os.Exit(1)
+	}
+	stopTLSWatcher := tlsCertHolder.watchSIGHUP(logger)
+	defer stopTLSWatcher()
+
 	// Server configuration
 	addr := net.JoinHostPort(cfg.Server.Host, strconv.Itoa(cfg.Server.Port))
 	httpServer := &http.Server{
 		Addr:              addr,
 		Handler:           finalHandler,
+		TLSConfig:         buildServerTLSConfig(tlsCertHolder),
 		ReadTimeout:       30 * time.Second,
 		ReadHeaderTimeout: 5 * time.Second,
 		WriteTimeout:      120 * time.Second, // Must accommodate ACME issuance (order + challenge + finalize)
 		IdleTimeout:       60 * time.Second,
 	}

-	// Start HTTP server in background
-	logger.Info("starting HTTP server", "address", addr)
+	// Start HTTPS server in background. ListenAndServeTLS is called with
+	// empty cert+key arguments because the cert is sourced through
+	// TLSConfig.GetCertificate (the SIGHUP-reloadable holder). Passing file
+	// paths here would pin the first-loaded cert and defeat hot reload.
+	logger.Info("HTTPS server listening",
+		"address", addr,
+		"cert_path", cfg.Server.TLS.CertPath,
+		"min_version", "TLS1.3")
 	go func() {
-		if err := httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			logger.Error("HTTP server error", "error", err)
+		if err := httpServer.ListenAndServeTLS("", ""); err != nil && err != http.ErrServerClosed {
+			logger.Error("HTTPS server error", "error", err)
 		}
 	}()

@@ -774,9 +806,9 @@ func main() {
 		logger.Warn("scheduler work did not complete in time", "error", err)
 	}

-	logger.Info("shutting down HTTP server")
+	logger.Info("shutting down HTTPS server")
 	if err := httpServer.Shutdown(shutdownCtx); err != nil {
-		logger.Error("HTTP server shutdown error", "error", err)
+		logger.Error("HTTPS server shutdown error", "error", err)
 	}

 	// Drain in-flight audit-recording goroutines before closing the DB pool.
@@ -214,6 +214,8 @@ func TestMain_ServerConfigFromEnvironment(t *testing.T) {
 	oldAuthType := os.Getenv("CERTCTL_AUTH_TYPE")
 	oldServerHost := os.Getenv("CERTCTL_SERVER_HOST")
 	oldServerPort := os.Getenv("CERTCTL_SERVER_PORT")
+	oldTLSCert := os.Getenv("CERTCTL_SERVER_TLS_CERT_PATH")
+	oldTLSKey := os.Getenv("CERTCTL_SERVER_TLS_KEY_PATH")
 	defer func() {
 		if oldAuthType != "" {
 			os.Setenv("CERTCTL_AUTH_TYPE", oldAuthType)
@@ -230,12 +232,32 @@ func TestMain_ServerConfigFromEnvironment(t *testing.T) {
 		} else {
 			os.Unsetenv("CERTCTL_SERVER_PORT")
 		}
+		if oldTLSCert != "" {
+			os.Setenv("CERTCTL_SERVER_TLS_CERT_PATH", oldTLSCert)
+		} else {
+			os.Unsetenv("CERTCTL_SERVER_TLS_CERT_PATH")
+		}
+		if oldTLSKey != "" {
+			os.Setenv("CERTCTL_SERVER_TLS_KEY_PATH", oldTLSKey)
+		} else {
+			os.Unsetenv("CERTCTL_SERVER_TLS_KEY_PATH")
+		}
 	}()

+	// HTTPS-only control plane: Validate() refuses to pass without a readable
+	// cert/key pair on disk. Materialize a throwaway ECDSA P-256 pair using the
+	// same generator cmd/server/tls_test.go uses for the certHolder tests.
+	dir := t.TempDir()
+	certPath := dir + "/server.crt"
+	keyPath := dir + "/server.key"
+	generateTestCert(t, certPath, keyPath, "main-test-cn")
+
 	// Set test env vars
 	os.Setenv("CERTCTL_AUTH_TYPE", "none")
 	os.Setenv("CERTCTL_SERVER_HOST", "127.0.0.1")
 	os.Setenv("CERTCTL_SERVER_PORT", "8080")
+	os.Setenv("CERTCTL_SERVER_TLS_CERT_PATH", certPath)
+	os.Setenv("CERTCTL_SERVER_TLS_KEY_PATH", keyPath)

 	cfg, err := config.Load()
 	if err != nil {
@@ -260,6 +282,8 @@ func TestMain_AuthTypeConfiguration(t *testing.T) {
 	// Save original env vars
 	oldAuthType := os.Getenv("CERTCTL_AUTH_TYPE")
 	oldAuthSecret := os.Getenv("CERTCTL_AUTH_SECRET")
+	oldTLSCert := os.Getenv("CERTCTL_SERVER_TLS_CERT_PATH")
+	oldTLSKey := os.Getenv("CERTCTL_SERVER_TLS_KEY_PATH")
 	defer func() {
 		if oldAuthType != "" {
 			os.Setenv("CERTCTL_AUTH_TYPE", oldAuthType)
@@ -271,8 +295,28 @@ func TestMain_AuthTypeConfiguration(t *testing.T) {
 		} else {
 			os.Unsetenv("CERTCTL_AUTH_SECRET")
 		}
+		if oldTLSCert != "" {
+			os.Setenv("CERTCTL_SERVER_TLS_CERT_PATH", oldTLSCert)
+		} else {
+			os.Unsetenv("CERTCTL_SERVER_TLS_CERT_PATH")
+		}
+		if oldTLSKey != "" {
+			os.Setenv("CERTCTL_SERVER_TLS_KEY_PATH", oldTLSKey)
+		} else {
+			os.Unsetenv("CERTCTL_SERVER_TLS_KEY_PATH")
+		}
 	}()

+	// HTTPS-only control plane: config.Load()→Validate() refuses to pass
+	// without a readable cert/key pair. Mint one throwaway pair for the whole
+	// sub-test cohort — auth type toggles don't care about the TLS surface.
+	dir := t.TempDir()
+	certPath := dir + "/server.crt"
+	keyPath := dir + "/server.key"
+	generateTestCert(t, certPath, keyPath, "main-test-cn")
+	os.Setenv("CERTCTL_SERVER_TLS_CERT_PATH", certPath)
+	os.Setenv("CERTCTL_SERVER_TLS_KEY_PATH", keyPath)
+
 	// Set auth secret for api-key mode
 	os.Setenv("CERTCTL_AUTH_SECRET", "test-secret")

@@ -0,0 +1,164 @@
+package main
+
+import (
+	"crypto/tls"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/signal"
+	"sync"
+	"syscall"
+)
+
+// certHolder stores the server's TLS certificate under a mutex so it can be
+// swapped atomically by a SIGHUP handler without restarting the server. A
+// *tls.Config that wires GetCertificate → (*certHolder).GetCertificate reads
+// through the holder on every ClientHello, so a successful reload takes
+// effect on the next new connection immediately and without dropping
+// in-flight requests.
+//
+// Concurrency: GetCertificate is invoked from crypto/tls handshake goroutines
+// on every new inbound connection; Reload is invoked from the SIGHUP watcher
+// goroutine. sync.Mutex is sufficient — TLS handshakes are not an inner-loop
+// hot path and the critical section is a single pointer read.
+type certHolder struct {
+	mu       sync.Mutex
+	cert     *tls.Certificate
+	certPath string
+	keyPath  string
+}
+
+// newCertHolder loads the initial cert+key pair from disk and returns a
+// holder ready to serve handshakes. Returns a non-nil error if either file
+// is missing, unreadable, or the pair does not round-trip through
+// tls.LoadX509KeyPair (for example the key does not sign the cert). The
+// caller is expected to treat a non-nil error as a fail-loud startup gate
+// and os.Exit(1) — the HTTPS-everywhere milestone (§3 locked decisions)
+// prohibits plaintext HTTP fallback.
+func newCertHolder(certPath, keyPath string) (*certHolder, error) {
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return nil, fmt.Errorf("load TLS cert/key (cert=%q key=%q): %w", certPath, keyPath, err)
+	}
+	return &certHolder{
+		cert:     &cert,
+		certPath: certPath,
+		keyPath:  keyPath,
+	}, nil
+}
+
+// GetCertificate is the tls.Config.GetCertificate hook. Returns the current
+// cert under the holder's mutex. ClientHelloInfo is ignored — the control
+// plane does not multiplex by SNI.
+func (h *certHolder) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.cert, nil
+}
+
+// Reload re-reads the cert+key pair from disk and swaps the holder
+// atomically on success. On failure the holder retains its previous cert
+// and the error is propagated to the caller — the SIGHUP watcher logs and
+// keeps serving the previous cert rather than crashing on a bad reload.
+// This is deliberately "fail-safe on reload, fail-loud on startup": an
+// operator rotating certs wants a recoverable error, not a restart loop.
+func (h *certHolder) Reload() error {
+	cert, err := tls.LoadX509KeyPair(h.certPath, h.keyPath)
+	if err != nil {
+		return fmt.Errorf("reload TLS cert/key (cert=%q key=%q): %w", h.certPath, h.keyPath, err)
+	}
+	h.mu.Lock()
+	h.cert = &cert
+	h.mu.Unlock()
+	return nil
+}
+
+// watchSIGHUP installs a signal handler that calls Reload() on each SIGHUP.
+// The returned stop function closes the internal done channel and stops
+// signal delivery so the goroutine can exit cleanly during shutdown. Errors
+// from Reload are logged but do not terminate the watcher — the operator
+// can fix the files and send another SIGHUP.
+//
+// Defensive design note: this deliberately does NOT panic on Reload error
+// even though HTTPS is mission-critical. A rotation that writes half-files
+// (operator overwrites cert.pem then key.pem as two separate copies) would
+// otherwise crash the server mid-rotation. Logging + retaining the old
+// cert gives the operator a bounded window to fix and re-SIGHUP.
+func (h *certHolder) watchSIGHUP(logger *slog.Logger) (stop func()) {
+	ch := make(chan os.Signal, 1)
+	signal.Notify(ch, syscall.SIGHUP)
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-ch:
+				if err := h.Reload(); err != nil {
+					logger.Error("TLS cert reload failed; continuing with previous cert",
+						"error", err,
+						"cert_path", h.certPath,
+						"key_path", h.keyPath)
+					continue
+				}
+				logger.Info("TLS cert reloaded via SIGHUP",
+					"cert_path", h.certPath,
+					"key_path", h.keyPath)
+			case <-done:
+				signal.Stop(ch)
+				return
+			}
+		}
+	}()
+	return func() { close(done) }
+}
+
+// buildServerTLSConfig returns the TLS 1.3-only *tls.Config for the HTTPS
+// server. Pinned per HTTPS-everywhere milestone §2.1 + §3 locked decisions:
+//
+//   - MinVersion: TLS 1.3 (no TLS 1.2 escape hatch). Go 1.25's crypto/tls
+//     automatically rejects older versions.
+//   - CurvePreferences: explicit [X25519, P-256]. Explicit ordering keeps
+//     the handshake deterministic and documents the accepted curves.
+//   - No CipherSuites field: TLS 1.3 cipher suites are not negotiable in
+//     the handshake (all three mandatory suites — AES-128-GCM-SHA256,
+//     AES-256-GCM-SHA384, CHACHA20-POLY1305-SHA256 — are always offered).
+//     Go's crypto/tls ignores CipherSuites for TLS 1.3.
+//   - GetCertificate: reads through the holder so SIGHUP rotations take
+//     effect on the next new connection without a restart. Setting
+//     tls.Config.Certificates directly would pin the first-loaded cert
+//     and defeat SIGHUP reload.
+func buildServerTLSConfig(holder *certHolder) *tls.Config {
+	return &tls.Config{
+		MinVersion:       tls.VersionTLS13,
+		CurvePreferences: []tls.CurveID{tls.X25519, tls.CurveP256},
+		GetCertificate:   holder.GetCertificate,
+	}
+}
+
+// preflightServerTLS is the fail-loud startup gate for HTTPS. Returns a
+// non-nil error when the TLS configuration is missing or the cert+key pair
+// cannot be parsed, so the caller refuses to start the control plane
+// (HTTPS-everywhere §3 locked decisions: no plaintext HTTP fallback).
+//
+// Duplicates the emptiness + stat + parse checks in config.Validate() for
+// defense in depth, mirroring the pattern established by
+// preflightSCEPChallengePassword (which itself duplicates
+// config.Validate()'s SCEP check for CWE-306). Extracted into a separate
+// function so the gate is unit-testable without booting the full server.
+func preflightServerTLS(certPath, keyPath string) error {
+	if certPath == "" {
+		return fmt.Errorf("CERTCTL_SERVER_TLS_CERT_PATH is empty: HTTPS-only control plane refuses to start (see docs/tls.md)")
+	}
+	if keyPath == "" {
+		return fmt.Errorf("CERTCTL_SERVER_TLS_KEY_PATH is empty: HTTPS-only control plane refuses to start (see docs/tls.md)")
+	}
+	if _, err := os.Stat(certPath); err != nil {
+		return fmt.Errorf("TLS cert file %q unreadable: %w (see docs/tls.md)", certPath, err)
+	}
+	if _, err := os.Stat(keyPath); err != nil {
+		return fmt.Errorf("TLS key file %q unreadable: %w (see docs/tls.md)", keyPath, err)
+	}
+	if _, err := tls.LoadX509KeyPair(certPath, keyPath); err != nil {
+		return fmt.Errorf("TLS cert/key pair invalid (cert=%q key=%q): %w (see docs/tls.md)", certPath, keyPath, err)
+	}
+	return nil
+}
@@ -0,0 +1,418 @@
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"io"
+	"log/slog"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// generateTestCert writes a PEM-encoded self-signed leaf cert + ECDSA P-256
+// key pair to certPath/keyPath. The subject is derived from cn so tests can
+// tell reloaded certs apart from original certs by re-parsing the served
+// Certificate and comparing the CN.
+func generateTestCert(t *testing.T, certPath, keyPath, cn string) {
+	t.Helper()
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("ecdsa.GenerateKey: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject:      pkix.Name{CommonName: cn},
+		NotBefore:    time.Now().Add(-1 * time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:     []string{"localhost"},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("::1")},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &priv.PublicKey, priv)
+	if err != nil {
+		t.Fatalf("x509.CreateCertificate: %v", err)
+	}
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyDER, err := x509.MarshalECPrivateKey(priv)
+	if err != nil {
+		t.Fatalf("MarshalECPrivateKey: %v", err)
+	}
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	if err := os.WriteFile(certPath, certPEM, 0o600); err != nil {
+		t.Fatalf("write cert: %v", err)
+	}
+	if err := os.WriteFile(keyPath, keyPEM, 0o600); err != nil {
+		t.Fatalf("write key: %v", err)
+	}
+}
+
+// readCertCN returns the CommonName from the leaf cert currently held by the
+// holder, by exercising the same GetCertificate path the tls handshake would
+// take. Lets tests assert which generation of the cert is being served.
+func readCertCN(t *testing.T, h *certHolder) string {
+	t.Helper()
+	c, err := h.GetCertificate(&tls.ClientHelloInfo{})
+	if err != nil {
+		t.Fatalf("GetCertificate: %v", err)
+	}
+	leaf, err := x509.ParseCertificate(c.Certificate[0])
+	if err != nil {
+		t.Fatalf("ParseCertificate: %v", err)
+	}
+	return leaf.Subject.CommonName
+}
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{Level: slog.LevelError}))
+}
+
+func TestNewCertHolder_ValidPair_LoadsCert(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-initial")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+	if got := readCertCN(t, h); got != "cn-initial" {
+		t.Fatalf("CN mismatch: got %q want %q", got, "cn-initial")
+	}
+}
+
+func TestNewCertHolder_MissingFile_Fails(t *testing.T) {
+	_, err := newCertHolder("/nonexistent/cert.pem", "/nonexistent/key.pem")
+	if err == nil {
+		t.Fatal("expected error for missing files, got nil")
+	}
+}
+
+func TestNewCertHolder_MalformedCert_Fails(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "bad.crt")
+	keyPath := filepath.Join(dir, "bad.key")
+	if err := os.WriteFile(certPath, []byte("not a pem cert"), 0o600); err != nil {
+		t.Fatalf("write cert: %v", err)
+	}
+	if err := os.WriteFile(keyPath, []byte("not a pem key"), 0o600); err != nil {
+		t.Fatalf("write key: %v", err)
+	}
+	_, err := newCertHolder(certPath, keyPath)
+	if err == nil {
+		t.Fatal("expected error for malformed PEM, got nil")
+	}
+}
+
+func TestCertHolder_Reload_SwapsCert(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-v1")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+	if got := readCertCN(t, h); got != "cn-v1" {
+		t.Fatalf("initial CN: got %q want cn-v1", got)
+	}
+
+	// Rotate on disk and reload.
+	generateTestCert(t, certPath, keyPath, "cn-v2")
+	if err := h.Reload(); err != nil {
+		t.Fatalf("Reload: %v", err)
+	}
+	if got := readCertCN(t, h); got != "cn-v2" {
+		t.Fatalf("post-reload CN: got %q want cn-v2", got)
+	}
+}
+
+func TestCertHolder_Reload_FailureRetainsPreviousCert(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-v1")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+
+	// Corrupt the cert file and attempt reload.
+	if err := os.WriteFile(certPath, []byte("garbage"), 0o600); err != nil {
+		t.Fatalf("corrupt cert: %v", err)
+	}
+	if err := h.Reload(); err == nil {
+		t.Fatal("expected Reload error for corrupt file, got nil")
+	}
+	// Holder should still serve the v1 cert.
+	if got := readCertCN(t, h); got != "cn-v1" {
+		t.Fatalf("post-failed-reload CN: got %q want cn-v1 (reload must not clobber on failure)", got)
+	}
+}
+
+func TestCertHolder_GetCertificate_Concurrent(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-concurrent")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+
+	// 64 readers + 1 rotator for 500ms. Race detector catches any unsynchronized
+	// swap of h.cert. Rotator writes fresh files + Reload, readers call
+	// GetCertificate in a tight loop.
+	var wg sync.WaitGroup
+	done := make(chan struct{})
+	const readers = 64
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-done:
+					return
+				default:
+					if _, err := h.GetCertificate(&tls.ClientHelloInfo{}); err != nil {
+						t.Errorf("GetCertificate: %v", err)
+						return
+					}
+				}
+			}
+		}()
+	}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 20; i++ {
+			generateTestCert(t, certPath, keyPath, "cn-concurrent")
+			_ = h.Reload()
+			time.Sleep(10 * time.Millisecond)
+		}
+	}()
+	time.Sleep(300 * time.Millisecond)
+	close(done)
+	wg.Wait()
+}
+
+func TestCertHolder_WatchSIGHUP_ReloadsOnSignal(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-before-sighup")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+	stop := h.watchSIGHUP(silentLogger())
+	defer stop()
+
+	// Rotate on disk, then fire SIGHUP to our own process and poll for the swap.
+	generateTestCert(t, certPath, keyPath, "cn-after-sighup")
+	if err := syscall.Kill(syscall.Getpid(), syscall.SIGHUP); err != nil {
+		t.Fatalf("SIGHUP: %v", err)
+	}
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if readCertCN(t, h) == "cn-after-sighup" {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("watcher did not reload cert within 2s (CN still %q)", readCertCN(t, h))
+}
+
+func TestCertHolder_WatchSIGHUP_StopExits(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-stop")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+	stop := h.watchSIGHUP(silentLogger())
+
+	// Closing should be synchronous and safe; a subsequent SIGHUP must not
+	// cause a reload (the watcher goroutine is gone).
+	stop()
+	time.Sleep(50 * time.Millisecond) // let goroutine exit
+
+	// After stop, the signal may still be delivered to the process but the
+	// watcher has called signal.Stop so this channel is no longer receiving.
+	// Simply assert that calling stop() twice does not panic — the goroutine
+	// has already exited, so a second close would panic on the `done`
+	// channel; we do NOT call stop twice. Instead verify no regression in
+	// the held cert.
+	if got := readCertCN(t, h); got != "cn-stop" {
+		t.Fatalf("unexpected cert rotation after stop: got %q want cn-stop", got)
+	}
+}
+
+func TestBuildServerTLSConfig_IsTLS13Only(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-cfg")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+	cfg := buildServerTLSConfig(h)
+	if cfg.MinVersion != tls.VersionTLS13 {
+		t.Fatalf("MinVersion: got %#x want %#x (TLS 1.3)", cfg.MinVersion, tls.VersionTLS13)
+	}
+	wantCurves := []tls.CurveID{tls.X25519, tls.CurveP256}
+	if len(cfg.CurvePreferences) != len(wantCurves) {
+		t.Fatalf("CurvePreferences length: got %d want %d", len(cfg.CurvePreferences), len(wantCurves))
+	}
+	for i, c := range cfg.CurvePreferences {
+		if c != wantCurves[i] {
+			t.Fatalf("CurvePreferences[%d]: got %v want %v", i, c, wantCurves[i])
+		}
+	}
+	if cfg.GetCertificate == nil {
+		t.Fatal("GetCertificate: nil (holder not wired; SIGHUP reload would be broken)")
+	}
+	if len(cfg.Certificates) != 0 {
+		t.Fatalf("Certificates: got %d want 0 (static cert would pin the first load and defeat reload)", len(cfg.Certificates))
+	}
+}
+
+func TestBuildServerTLSConfig_Handshake_TLS12Rejected(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-handshake")
+
+	h, err := newCertHolder(certPath, keyPath)
+	if err != nil {
+		t.Fatalf("newCertHolder: %v", err)
+	}
+	serverCfg := buildServerTLSConfig(h)
+
+	ln, err := tls.Listen("tcp", "127.0.0.1:0", serverCfg)
+	if err != nil {
+		t.Fatalf("tls.Listen: %v", err)
+	}
+	defer ln.Close()
+
+	// Server loop: accept and immediately close (we only care about the
+	// handshake outcome).
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			// Force handshake so the server-side error surfaces.
+			_ = conn.(*tls.Conn).Handshake()
+			conn.Close()
+		}
+	}()
+
+	// TLS 1.3 client — should succeed.
+	clientOK := &tls.Config{
+		MinVersion:         tls.VersionTLS13,
+		MaxVersion:         tls.VersionTLS13,
+		InsecureSkipVerify: true,
+	}
+	c, err := tls.Dial("tcp", ln.Addr().String(), clientOK)
+	if err != nil {
+		t.Fatalf("TLS 1.3 dial failed (expected success): %v", err)
+	}
+	if c.ConnectionState().Version != tls.VersionTLS13 {
+		t.Fatalf("negotiated version: got %#x want TLS 1.3 (%#x)", c.ConnectionState().Version, tls.VersionTLS13)
+	}
+	c.Close()
+
+	// TLS 1.2 client — must be rejected at handshake.
+	clientOld := &tls.Config{
+		MinVersion:         tls.VersionTLS12,
+		MaxVersion:         tls.VersionTLS12,
+		InsecureSkipVerify: true,
+	}
+	if _, err := tls.Dial("tcp", ln.Addr().String(), clientOld); err == nil {
+		t.Fatal("TLS 1.2 dial succeeded; HTTPS-everywhere requires server to refuse TLS 1.2")
+	}
+}
+
+func TestPreflightServerTLS_MissingCertPath(t *testing.T) {
+	err := preflightServerTLS("", "/any/key.pem")
+	if err == nil {
+		t.Fatal("expected error for empty cert path, got nil")
+	}
+}
+
+func TestPreflightServerTLS_MissingKeyPath(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-preflight")
+	err := preflightServerTLS(certPath, "")
+	if err == nil {
+		t.Fatal("expected error for empty key path, got nil")
+	}
+}
+
+func TestPreflightServerTLS_CertFileNotReadable(t *testing.T) {
+	dir := t.TempDir()
+	keyPath := filepath.Join(dir, "tls.key")
+	if err := os.WriteFile(keyPath, []byte("k"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := preflightServerTLS(filepath.Join(dir, "nope.crt"), keyPath)
+	if err == nil {
+		t.Fatal("expected error for unreadable cert path, got nil")
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected os.ErrNotExist wrapped in error chain, got: %v", err)
+	}
+}
+
+func TestPreflightServerTLS_InvalidKeyPair(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	// Pair of valid cert + garbage key — files are readable but the pair
+	// doesn't round-trip tls.LoadX509KeyPair.
+	generateTestCert(t, certPath, keyPath, "cn-bad-pair")
+	if err := os.WriteFile(keyPath, []byte("-----BEGIN EC PRIVATE KEY-----\nBAD\n-----END EC PRIVATE KEY-----\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := preflightServerTLS(certPath, keyPath)
+	if err == nil {
+		t.Fatal("expected error for invalid key pair, got nil")
+	}
+}
+
+func TestPreflightServerTLS_ValidPair_NoError(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "tls.crt")
+	keyPath := filepath.Join(dir, "tls.key")
+	generateTestCert(t, certPath, keyPath, "cn-ok")
+	if err := preflightServerTLS(certPath, keyPath); err != nil {
+		t.Fatalf("unexpected error for valid pair: %v", err)
+	}
+}