eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OpenSSH certificate signing path

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:56:47 +02:00
commit 91c65e367d
9 changed files with 160 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

11
README.md
View file

@ -58,10 +58,11 @@ over authorized Iroh streams, but the geth transport remains Iroh.
SSH certificate request and renewal flows are managed as geth metadata. A node
can create a certificate request, another machine can approve it and receive an
explicit `ssh-keygen -s ...` command suitable for a CA key or YubiKey-backed CA,
and the resulting `-cert.pub` can be imported for distribution. Certificate and
key revocation entries are tracked locally and can be exported as JSONL or as an
OpenSSH KRL specification file or a binary OpenSSH KRL generated through
`ssh-keygen -k`. `geth ssh cert sync <node-id>` and
or pass `--sign` to run `ssh-keygen` immediately and import the resulting
`-cert.pub` for distribution. Certificate and key revocation entries are tracked
locally and can be exported as JSONL or as an OpenSSH KRL specification file or
a binary OpenSSH KRL generated through `ssh-keygen -k`. `geth ssh cert sync
<node-id>` and
`geth ssh revocation sync <node-id>` pull certificate-flow and revocation
metadata from an authorized peer over Iroh.
@ -114,7 +115,7 @@ The bootstrap implementation provides:
- SSH certificate flow metadata:
- `geth ssh cert request --public-key <path> --principal <name> [--subject <principal>]`
- `geth ssh cert requests [--subject <principal>]`
- `geth ssh cert approve <request-id> --ca-key <path> [--subject <principal>]`
- `geth ssh cert approve <request-id> --ca-key <path> [--sign] [--subject <principal>]`
- `geth ssh cert import <request-id> --cert <path> [--subject <principal>]`
- `geth ssh cert list [--subject <principal>]`
- `geth ssh cert sync <node-id>`