Offline TOTP — Operator training

Your CA must not depend on the identity provider it issues certificates for — so what protects the administrator account when there is no IdP to lean on? Every local password identity that resolves to system-admin must use RFC 6238 TOTP, and the factor is offline: goca builds the QR code inside its own management process, and your authenticator generates codes with no network and no third party.

The password alone never yields an administrator session — it returns a five-minute challenge. On first login you scan the QR, confirm a current six-digit code, and store ten recovery codes. A mistyped code does not burn the challenge; the fifth one does. A TOTP value cannot be replayed, even through a fresh browser request.

Metaphor: a safe with a combination dial built into the door — no wire runs to a security company that could be offline, bought, or breached.

Where it breaks: a safe dial never changes; TOTP codes rotate every 30 seconds, which is the point — and your phone's clock has to agree.

Now I can enroll TOTP that works with no IdP and no internet.