[#385] SSH CA live on fleet step-ca: user cert issuance + e2e ssh auth PROVEN

ED25519 user/host CA keys generated; enableSSHCA on JWK provisioner;
24h root principal cert issued and used to ssh into sectestbed 5104
(passwordless, no static key). Host onboarding = 1 file + reload.
Rollout role queued in KNELIAC. Public CA key committed (private keys
never leave tsys-ca).
https://projects.knownelement.com/issues/385

.crush/active-ticket

@@ -1 +1 @@
-#800
+#385

docs/runbook-ssh-ca.md

@@ -0,0 +1,45 @@
+# SSH certificate CA runbook — step-ca on tsys-ca
+
+> Ticket [#385](https://projects.knownelement.com/issues/385) · parent
+> [#697](https://projects.knownelement.com/issues/697)/[#800](https://projects.knownelement.com/issues/800)
+> Lane index https://community.turnsys.com/t/297
+
+## Live state (2026-09-05)
+
+- SSH CA enabled on the prod step-ca (same endpoint as ACME:
+  https://100.102.96.24:8443). Separate ED25519 signing keys:
+  `ssh_host_ca_key` + `ssh_user_ca_key` (in /opt/stepca-prod/data/secrets,
+  never leave the host). Public CA: `ssh-ca/fleet_user_ca.pub` in this repo
+  + artifact mirror.
+- Provisioner: JWK `admin` with `claims.enableSSHCA=true`.
+- **VERIFIED e2e**: user cert (principal root, 24h) issued and used to SSH
+  into sectestbed 5104 — passwordless, no static key. PLAYBOOK RECORD in
+  journal of #385.
+
+## Host onboarding (one file + one reload)
+
+    install -m 644 fleet_user_ca.pub /etc/ssh/fleet_user_ca.pub
+    echo "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub" > /etc/ssh/sshd_config.d/99-fleet-ca.conf
+    systemctl reload sshd
+
+Rollout to the fleet = KNELIAC role (queued; sectestbed wave first, then
+prod hosts under GLPI CR).
+
+## Client flow (operators + automation)
+
+    step ssh certificate root-cert ./id_root --principal root \
+      --provisioner admin --provisioner-password-file <pw> \
+      --ca-url https://100.102.96.24:8443 --root fleet-root.crt \
+      --not-after 24h
+    ssh -i ./id_root -o CertificateFile=./id_root-cert.pub root@<host>
+
+Better UX once keyed hosts trust the CA: `step ssh login` (agent-managed,
+`step ssh` known-hosts propagation via `--ssh` host templates — queued).
+
+## Hardening TODO (before prod wave)
+
+- host certificates (`--host`) + sshd HostCertificate so CLIENTS also
+  verify servers (kills TOFU).
+- JWK admin provisioner → per-operator provisioners; automation gets a
+  dedicated provisioner with restricted principals + short TTLs.
+- Enable `--acme-strict-fqdn`-style hygiene: review principals allowed.

ssh-ca/fleet_user_ca.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtlhPfNlm/6bJqPRQv7jsrt1sMUTKgAAwUh0yZCESNU KNEL Fleet SSH User CA