ca.srl stays root-owned after a privileged proxy start

Version

0.15.8. Still present in 0.17.0 and on main.

Steps to reproduce

1. Start the proxy once as root, so ~/.portless/ca.srl is created as root. sudo portless proxy start is one way.
2. Stop it, then start the proxy as your user.
3. Request a new hostname.
4. ~/.portless/host-certs/<host>.pem is 0 bytes. The TLS request resets.

Without root: chmod 444 ~/.portless/ca.srl gives the same failure.

Expected behavior

ca.srl should get the same fixOwnership call as the other CA files. A failed signature should remove the partial certificate and log the OpenSSL error.

Actual behavior

The proxy can read ca.srl, so signing starts. OpenSSL writes the certificate, then fails to update the serial:

/Users/<user>/.portless/ca.srl: Permission denied

The 0-byte certificate stays on disk. createSNICallback fails the handshake, so the client gets a TLS error or reset. The signing error is not logged. The empty certificate is not served.

Environment

• macOS 27.0.1 arm64
• Node.js 26.13.0
• portless 0.15.8, proxy on port 1355

Additional context

Related to #287, not a duplicate. #287 proposes dropping privileges before spawning child processes. ca.srl is written by the proxy during certificate setup, so that proposed change alone would not cover it.

fixOwnership covers the other CA and certificate files, but not srlPath, in both signing paths in packages/portless/src/certs.ts. PR #53 added the ownership fix for state files but not ca.srl. PR #157 added the explicit ca.srl path but not ownership.