skarbiec ssh sign

Invocation#

skarbiec ssh sign <ca-id> <public-key-file> --identity <name> --principals <name,...> --validity <window> [--host]

Purpose#

Let people and machines into servers with short-lived SSH certificates from an authority the vault keeps, so no server's authorized_keys has to list every key and access ends when the certificate does.

Required inputs and options#

• The certificate authority's item, holding the authority's private key in private_key — a key-pair item, such as one ssh new made — and the path of the public key to sign. --identity names whom the certificate is for, as ssh-keygen -I takes it; --principals the user or host names it is valid for, comma separated, as -n takes them; --validity the window, as -V takes it, such as +8h or 20260101:20260201. All three are required: how long access lasts is the owner's to state. --host signs a server's host key instead of a user's, as -h does. POST /v1/operator/ssh-sign takes ca, public_key_file (absolute, on the machine serving the API), identity, principals, validity and host, and is never forwarded.

Output and state effects#

• Writes the authority's key, owner-only, into a directory beside the vault that only the owner can open, runs ssh-keygen -s there, reads the certificate and removes the directory before answering, so the authority's key never stays on disk; appends ssh-cert-signed naming the authority, identity, principals, validity and whether it was a host key, and prints ok, ca, identity, principals, validity, host and certificate, the line to save as <key>-cert.pub beside the public key, where ssh finds it. Servers trust a user authority with TrustedUserCAKeys naming its public key; clients trust a host authority with a @cert-authority line in known_hosts, and a server presents its host certificate with HostCertificate. Desktop's key-pair inspector has Sign an SSH key with this authority.

Refusals#

• Anything but an authority and one file exits 2 with the usage, and a missing or empty --identity, --principals or --validity exits 2 naming it. A public key file that cannot be read fails naming it, an authority item without private_key text with `<ca> holds no private_key text, so there is no authority to sign with`, and ssh-keygen's refusal — a key that is not a public key, a window it cannot read, an authority key with a passphrase — with `ssh-keygen refused to sign <file> with <ca> (<status>): <its words>`.

Examples#

skarbiec ssh new ops-ca --name 'Ops SSH authority' skarbiec get ops-ca --field public_key | sudo tee /etc/ssh/ops-ca.pub # and TrustedUserCAKeys /etc/ssh/ops-ca.pub in sshd_config skarbiec ssh sign ops-ca ~/.ssh/id_ed25519.pub --identity alice@laptop --principals deploy --validity +8h | jq -r .certificate > ~/.ssh/id_ed25519-cert.pub