Cryptography & mTLS

Security in RasnuOS is not an afterthought; it is the foundational layer of the agent architecture.

Because the agent is establishing an outbound connection to the control plane, we must mathematically guarantee two things:

1. The Control Plane knows exactly which Agent is talking to it (No spoofed servers).
2. The Agent knows exactly that it is talking to the real Control Plane (No Man-in-the-Middle attacks).

Mutual TLS (mTLS)

We achieve this through Mutual TLS (mTLS). Standard HTTPS (TLS) only verifies the server's identity to the client. mTLS verifies both parties.

When you first install the RasnuOS agent, a secure handshake occurs:

1. A unique, mathematically secure Private Key is generated locally on your server.
2. The agent registers with the Control Plane and receives a unique Client Certificate signed by the RasnuOS Certificate Authority.
3. From that moment on, every single byte of telemetry, log data, and heartbeat is encrypted and authenticated using that specific Client Certificate.

If a malicious actor tries to send fake telemetry data to the RasnuOS Control Plane claiming to be your server, the connection is instantly dropped at the edge network because they do not possess your server's unique Private Key.

Encrypted Secrets at Rest (HashiCorp Vault)

Your environment variables, database passwords, and API keys are the most sensitive data in your organization.

Unlike legacy panels that store your .env files in plain text in their databases, RasnuOS utilizes a highly secure HashiCorp Vault Transit Secrets Engine.

• When you save a secret in the dashboard, it is immediately encrypted by Vault.
• The RasnuOS database only stores the resulting ciphertext (vault:v1:aB3...).
• The secrets are only decrypted in memory at the exact moment the Agent requests them for deployment.
• Zero-Knowledge Guarantee: It is mathematically impossible for RasnuOS engineers or database administrators to read your private keys.