39 lines
1.4 KiB
Markdown
39 lines
1.4 KiB
Markdown
|
# ADR 0014: SSH Certificate Flows And Revocation Lists
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
Accepted.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
Geth manages OpenSSH certificate request, renewal, approval, import, and
|
||
|
|
revocation-list metadata.
|
||
|
|
|
||
|
|
A node may request a user or host certificate by submitting its public key,
|
||
|
|
principals, requested validity, and optional renewal target. An authorized
|
||
|
|
machine can approve that request. Approval does not silently sign inside the
|
||
|
|
daemon; it returns an explicit `ssh-keygen -s ...` command that can be run on the
|
||
|
|
machine with the CA private key or YubiKey-backed CA key. The resulting
|
||
|
|
`-cert.pub` file is imported back into geth for distribution.
|
||
|
|
|
||
|
|
Certificate and key revocations are durable records. The bootstrap stores and
|
||
|
|
exports them as JSONL. Future work may derive OpenSSH KRL files and replicate
|
||
|
|
signed revocation lists over Iroh.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
|
||
|
|
SSH certificate lifecycle management becomes part of the SSH trust integration
|
||
|
|
layer without making SSH a geth transport. The daemon can coordinate requests and
|
||
|
|
distribution while the CA/YubiKey machine remains the explicit signing point.
|
||
|
|
|
||
|
|
Future authorization should protect capabilities such as:
|
||
|
|
|
||
|
|
- `ssh_cert.request`
|
||
|
|
- `ssh_cert.approve`
|
||
|
|
- `ssh_cert.import`
|
||
|
|
- `ssh_revocation.publish`
|
||
|
|
- `ssh_revocation.read`
|
||
|
|
|
||
|
|
The current bootstrap does not claim that revocation reaches offline nodes
|
||
|
|
immediately. Revocation distribution is eventual until stronger synchronization
|
||
|
|
and policy enforcement are implemented.
|