Your new CA accepts a password that is printed in its own manual. That is not an oversight — a fresh install has to be usable by somebody — but it is a state you should stay in for minutes, not days.
First login, three things, in order:
- Open
https://127.0.0.1:8085and sign in asadmin/admin. This bootstrap account exists so a fresh install is usable; the server logs a loud warning until its password changes. - Change the password — console: Users → your identity, or
POST /v1/identities/admin/password. The warning stops when you do. - Set a real master secret before creating anything you intend to keep (next frame). The compose bundle ships a development value; a CA hierarchy created under it is protected by a public string.
The order matters: a hierarchy minted before step 3 has to be thrown away, not migrated. Do the three steps before you show anyone the console, and the window where your CA answers to a documented credential closes in under a minute.
Now my install no longer accepts the password printed in the manual.