Files

T

ci / audit (push) Failing after 39s

Details

[#385 ] SSH CA live on fleet step-ca: user cert issuance + e2e ssh auth PROVEN

ED25519 user/host CA keys generated; enableSSHCA on JWK provisioner;
24h root principal cert issued and used to ssh into sectestbed 5104
(passwordless, no static key). Host onboarding = 1 file + reload.
Rollout role queued in KNELIAC. Public CA key committed (private keys
never leave tsys-ca).
https://projects.knownelement.com/issues/385

2026-09-05 17:08:16 -05:00

1.9 KiB

Raw Permalink Blame History

SSH certificate CA runbook — step-ca on tsys-ca

Ticket #385 · parent #697/#800 Lane index https://community.turnsys.com/t/297

Live state (2026-09-05)

SSH CA enabled on the prod step-ca (same endpoint as ACME: https://100.102.96.24:8443). Separate ED25519 signing keys: ssh_host_ca_key + ssh_user_ca_key (in /opt/stepca-prod/data/secrets, never leave the host). Public CA: ssh-ca/fleet_user_ca.pub in this repo
- artifact mirror.
Provisioner: JWK admin with claims.enableSSHCA=true.
VERIFIED e2e: user cert (principal root, 24h) issued and used to SSH into sectestbed 5104 — passwordless, no static key. PLAYBOOK RECORD in journal of #385.

Host onboarding (one file + one reload)

install -m 644 fleet_user_ca.pub /etc/ssh/fleet_user_ca.pub
echo "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub" > /etc/ssh/sshd_config.d/99-fleet-ca.conf
systemctl reload sshd

Rollout to the fleet = KNELIAC role (queued; sectestbed wave first, then prod hosts under GLPI CR).

Client flow (operators + automation)

step ssh certificate root-cert ./id_root --principal root \
  --provisioner admin --provisioner-password-file <pw> \
  --ca-url https://100.102.96.24:8443 --root fleet-root.crt \
  --not-after 24h
ssh -i ./id_root -o CertificateFile=./id_root-cert.pub root@<host>

Better UX once keyed hosts trust the CA: step ssh login (agent-managed, step ssh known-hosts propagation via --ssh host templates — queued).

Hardening TODO (before prod wave)

host certificates (--host) + sshd HostCertificate so CLIENTS also verify servers (kills TOFU).
JWK admin provisioner → per-operator provisioners; automation gets a dedicated provisioner with restricted principals + short TTLs.
Enable --acme-strict-fqdn-style hygiene: review principals allowed.

1.9 KiB Raw Permalink Blame History