One Certificate Authority Instead Of authorized_keys

ssh-ca

One certificate authority instead of a public key on every host. sshd can trust a CA and accept any certificate it signed, with a principal list, a validity window and a revocation list - so access is granted by signing and withdrawn by expiry rather than by editing authorized_keys everywhere. This role configures that trust and proves it four ways: the matching certificate gets in, one for another principal does not, an expired one does not, and a key the CA never signed does not.

No download, and no version to pin. openssh-server is EL 10. What the role owns is one sshd drop-in and the mode of the CA public key it points at - and what it will not do is create a certificate authority, because the private half belongs somewhere this host cannot reach.

One certificate does not open every account. AuthorizedPrincipalsFile defaults to none, and sshd then requires the account being logged into to appear in the certificate's principal list - measured, a certificate naming one account was refused by another. That is the check doing the work by default, and it is why the stricter per-account file is off.

AuthorizedPrincipalsFile fails CLOSED, so it is off by default. With it set, an account whose principals file is EMPTY is refused, and an account with no principals file at all is refused too. Both measured. It is the stricter shape and worth having, but turning it on without a file for every account that has to keep working takes the host away.

The role refuses to run without the CA public key, on purpose. TrustedUserCAKeys pointing at a file that is not there leaves sshd trusting nothing and every certificate refused - which looks exactly like a broken CA rather than a missing file. So the role checks first and stops with a message that says where to put the key, and it never generates one: a role that created a certificate authority on every managed host would be handing out signing authority.

Revocation is the other half of a CA, and it works. ssh-keygen -k -f makes an empty KRL, -k -u -f adds a certificate to it, and with RevokedKeys in the drop-in that certificate is refused while another one from the same CA still gets in. It is off by default because RevokedKeys naming a file that is not there is another way to lose every login.

sshd says which rule refused, and the test reads it. Three of the four cases are refusals, and only the journal distinguishes them: "error: Certificate invalid: expired" for the expired one, and an accepted login records the certificate type, its ID, its serial and the CA's fingerprint. The live test asserts the expiry message rather than treating three identical refusals as three different proofs.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.