Run your own certificate authority

Any Keychain key can be a CA, if no host, group or identity logs in with it. A CA key should only sign.

1. Make the CA

1. Generate a key for it (Ed25519 is a good choice).
2. On its page, open Certificate authority and choose Use as certificate authority….
3. Set the Longest certificate (hours) it may sign, up to 366 days.

2. Trust it on your servers

Choose Copy CA public key, add the line to the file TrustedUserCAKeys names in each server’s sshd_config, and reload sshd.

3. Sign a certificate

1. On the CA, choose Sign a certificate… and pick the Key to certify.
2. Choose a user or host certificate, the Principals (user names it’s valid for) and how long it lasts (8 hours by default). Optionally add a Forced command, the source addresses allowed and the OpenSSH extensions.
3. Check the CA, key fingerprint, principals, lifetime and restrictions in Sternway’s own dialog, and confirm.

The certificate is saved with the key. Signing happens on your device, and the CA’s private key never goes to a server. Serials are 64 random bits, so revoke by serial, key ID or key, never by range.

Trust host certificates

Trust for host keys… on the CA adds an @cert-authority known host for a pattern such as *.example.com. A server presenting a host certificate from this CA for its name is then known without asking.

Caution

In a shared vault, everyone who can edit it can sign for any principals up to the longest certificate, and everyone in it holds the CA key. Sternway warns you. Keep a CA only you sign with in your personal vault. A CA key is never put in a forwarded agent.