SSH Certificate Authority

The SSH CA administrative console (/admin/ssh) provides real-time visibility into your instance’s OpenSSH Certificate Authority, issued client certificates, and the Key Revocation List (KRL).

Establishing Target Host Trust

To establish host trust across your server fleet, target Linux hosts must be configured to trust the instance CA public key.

Retrieving the CA Public Key

The CA public key is exposed as a plain OpenSSH public key string at:

GET /api/ssh/ca/pubkey

Download the key on your target servers:

curl -fsSL https://api.example.com/api/ssh/ca/pubkey -o /etc/ssh/trusted_user_ca.pub
chmod 644 /etc/ssh/trusted_user_ca.pub

Append the trust directive to /etc/ssh/sshd_config:

TrustedUserCAKeys /etc/ssh/trusted_user_ca.pub

Reload sshd:

sudo systemctl reload sshd

---

Certificate Inventory & Monitoring

Under Admin -> SSH CA, the certificate ledger displays all issued certificates across the tenant:

• Key ID: The unique identity string embedded in the certificate (typically username-timestamp).
• Serial Number: The 64-bit monotonic unsigned integer (e.g. 117284521030851699), with full support for decimal and hex search (0x...).
• Principals: UNIX usernames authorized by the certificate.
• Issuing Metadata: Client IP address (client_ip) and timestamp.

Certificate Lifecycle States

Status	Condition	Host SSH Behavior
Active	Certificate is valid, unexpired, and unrevoked.	Accepted by sshd for authorized principals.
Revoked	Explicitly revoked by an administrator; recorded in dynamic KRL.	Rejected at target hosts upon KRL sync.
Expired	Validity timestamp (validBefore) has passed.	Target host sshd rejects automatically.

---

Revoking a Certificate

If a user device or private key is compromised:

1. Navigate to Admin -> SSH CA (/admin/ssh).

2. Filter certificates using the search box (supports searching by Key ID, Serial, or Principal).

3. Click the red Revoke button on the certificate entry.

4. In the confirmation modal, enter an optional audit reason (e.g., "Lost laptop", "Contract terminated").

5. Click Revoke certificate.

Revocation Propagation

Revocation is instantaneous in the database. Within seconds, the serial number is served by /api/ssh/ca/revoked-keys?format=raw and synchronized by host systemd timers.