stacklok / stacklok/mecatl

Connecting to a private-CA mecatui server requires retyping the TLS CA path on every connection

Open
#886 0 comments 0 reactions 1 assignee View on GitHub

@JAORMX is already working on this.

Since Sep 8, 2026.

Dominant language
Go
Stars
152
Forks
16
Avg merge
14h 48m
Merged PRs (30d)
536

Description

The problem

Logging in to a remote target once with mecatui login ADDRESS ... is a one-time thing -- after that, mecatui connect ADDRESS reconnects without needing to repeat any of the OIDC details.

But if the server is on a private CA, every single connect still needs:

mecatui connect ADDRESS --tls --tls-ca <server-ca>

typed out in full, for the life of that target. It's not a one-time setup cost like login -- it's a permanent tax on every reconnect, for a value that never changes for that target.

Impact

In practice this means either retyping the same long command every time, or building my own workaround (shell alias, script, etc.) just to get back to a plain mecatui connect ADDRESS.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.