Use SSH certificates (your own CA, Step CA, opkssh)

An OpenSSH user certificate is a key’s public half signed by a certificate authority (CA) the server trusts. When a key in the Keychain has a valid user certificate, logging in with that key presents it. Certificates live under Keychain › Certificates, attached to their key.

There are three ways to get one, and you can also attach a certificate you got elsewhere.

Attach a certificate you already have

1. Open Keychain › Certificates and choose Attach certificate.
2. Paste the contents of the -cert.pub file. Sternway reads its type, principals, validity and key ID, and attaches it to the matching key.

Run your own certificate authority (desktop)

Any key in the Keychain can be a CA, as long as no host, group or identity logs in with it: a CA key should sign certificates and do nothing else.

1. Generate a key for the CA (Ed25519 is a good choice), then on its page open Certificate authority and choose Use as certificate authority…. Set the Longest certificate (hours) it may sign, at most 366 days.
2. Choose Copy CA public key and add that line to the file TrustedUserCAKeys names in each server’s sshd_config, then reload sshd.
3. To give a key a certificate, choose Sign a certificate… on the CA and pick the Key to certify, a user or host certificate, the Principals (the user names it is valid for), how long it lasts (8 hours unless you choose otherwise), and optionally a Forced command, the addresses it may be used from and the OpenSSH extensions it allows.
4. Sternway shows what it is about to sign in a dialog of its own (the CA, the key and its fingerprint, the principals, how long, the restrictions). Confirm, and the certificate is saved with the key.

Signing happens on your device; the CA’s private key never goes to a server. Serial numbers are 64 random bits, so revoke a certificate by its serial, its key ID or its key, not by a range.

Host certificates: Trust for host keys… on the CA adds an @cert-authority known host for a pattern such as *.example.com, so a server presenting a host certificate from this CA for its name is known without asking.

A CA in a shared vault: everyone who can edit that vault can sign with it, for any principals, up to its longest certificate, and everyone in the vault holds its key. Sternway warns when you make one there. For a CA only you sign with, keep it in your personal vault. A CA key is never put in a forwarded agent.

Get short-lived certificates from a Step CA (desktop)

1. On a key’s page open Step CA and choose Get certificates from a Step CA….
2. Fill in the CA address, its Root fingerprint (as step ca bootstrap uses it), the Provisioner and the Principals to ask for.
3. Choose Get a certificate. For a JWK provisioner, type its Provisioner password; for an OIDC provisioner, your browser opens your identity provider’s sign-in.

Sternway trusts only the root whose fingerprint you entered, speaks only HTTPS (plain HTTP only to this computer), and keeps a certificate only if it is for exactly the key it sent, for principals you asked for, and valid now. The provisioner password is used once and never saved.

For a key in a vault other people can change, Sternway asks before it first uses the Step CA settings, and again after anyone changes them, naming the CA’s host and the sign-in host.

Use opkssh certificates

Sternway does not run the opkssh sign-in itself. Use the files opkssh writes:

1. Run opkssh login on a computer. It writes a key (for example ~/.ssh/id_ecdsa) and its certificate (~/.ssh/id_ecdsa-cert.pub).
2. Keychain › Keys › Import the key file.
3. Keychain › Certificates › Attach certificate with the contents of the -cert.pub file.
4. Log in with that key. opkssh certificates last hours: when it expires, run opkssh login again and attach the new certificate.

Next

• Every field of certificates, the CA and Step CA: Keychain.