eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
geth/docs/adr/0014-ssh-certificate-flows.md

1.4 KiB
Raw Blame History

ADR 0014: SSH Certificate Flows And Revocation Lists

Status

Accepted.

Decision

Geth manages OpenSSH certificate request, renewal, approval, import, and revocation-list metadata.

A node may request a user or host certificate by submitting its public key, principals, requested validity, and optional renewal target. An authorized machine can approve that request. Approval does not silently sign inside the daemon; it returns an explicit ssh-keygen -s ... command that can be run on the machine with the CA private key or YubiKey-backed CA key. The resulting -cert.pub file is imported back into geth for distribution.

Certificate and key revocations are durable records. The bootstrap stores and exports them as JSONL. Future work may derive OpenSSH KRL files and replicate signed revocation lists over Iroh.

Consequences

SSH certificate lifecycle management becomes part of the SSH trust integration layer without making SSH a geth transport. The daemon can coordinate requests and distribution while the CA/YubiKey machine remains the explicit signing point.

Future authorization should protect capabilities such as:

  • ssh_cert.request
  • ssh_cert.approve
  • ssh_cert.import
  • ssh_revocation.publish
  • ssh_revocation.read

The current bootstrap does not claim that revocation reaches offline nodes immediately. Revocation distribution is eventual until stronger synchronization and policy enforcement are implemented.