Ssh – use a CA certificate to authenticate a SSH server

certificate-authorityssh

I manage a SSH server and I want to validate it when clients tries to authenticate.
I've read a couple of tutorial (How To Create an SSH CA to Validate Hosts and Clients with Ubuntu and USING OPENSSH CERTIFICATE AUTHENTICATION). Both describe how I can use a self signed CA to sign my SSH server pub key. But in this case I already have a CA certificate from GeoTrust, and I'd like to use it.

Is it correct to follow the usual procedure in order to sign the ssh_host_rsa_key.pub file?

Thanks in advance.

Best Answer

The guides you are referring to talks about OpenSSH certificates and NOT x509 certificates like the ones you can get from GeoTrust. These are a very different things.

If you want to use the OpenSSH method (which I really like and use myself both at work and privately. Even facebook uses it: https://code.facebook.com/posts/365787980419535/scalable-and-secure-access-with-ssh/) you will use a regular private ssh key to sign your server keys. There is no CA certificate in play using this method, only a private key.

Just create a new keypair using ssh-keygen and be sure to keep the private key secret. Then you can follow the guides you are referring to, to sign your hostkeys. I have also written a guide myself that you can find here: https://framkant.org/2016/10/setting-up-a-ssh-certificate-authority-ca/

When the hostkeys are signed you can just tell your clients to trust the public part of your "signing key" but putting something like this in the known_hosts file:

@cert-authority * ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3pcm4IJGw76YKZSrf7pZA6s3Hu9eRzKbyzKPgg5OkBWU9ztUz2e1bXtR0UDqQKuOUx+ZDx6wmR3rVRM/BhYt1oeAv6rhxNRW2XPiakpn3EzuEWlbp68QRY8p+k6gjy7cnvF2uyaP0R0Ov819tTMHkdS3Rn57m7pfFk+tuRKLjJnQN2g6uxT+PBJonTQr2XcS5oAzwjel1x7xLqmz0MMrE98uE0GaZHxf/hioXOHt1ihzTF+GPqZ31ZrR3GIWtFEKtvcroaiS25VIV9W39LfVh7RRZTh8oCrjcEdoeFKUKA1PpqblsJhqg1XU2/xa9CAKb6SHb7gwQ18nUaQ/Sk6qYJMgkwWUtXbwS1RIm1k5QlKk8VD4H10jyqiAUBC8SHfNxnqOwKe275AfOVc/iuh4F2NsrIuHfh8tno5LqWSP63D3gXpXXm/4j3Sop2NqNz6EIqoqj0HPIL21/SneJgWXS7xxV/ShgnLVGB0dsJf8PsCnsVt0s5thO22VvE/IVQ1KM/ac1lEafBeSZsuPiOfcIeZu9mm4DfuoyqaHmnV6yBguW6zb894IdcYXsrVnMy3Hp85gnymEZn/qfPJ+dhNbBAANgjWphz5ZaBKdrpgCESz8Ka9S6V7fXr2ikB21YiUKB7XuoPjDncOokSEHU0p5iMQjE+Le7K3nOTtokhrZjXw==
Related Topic