Monday, March 02, 2009
Using signed certificates with OpenSSH
A few months ago, I started playing around with secure certificates. I downloaded TinyCA, a simple interface to OpenSSL that's enough to run a simple certificate authority. Using that, I created a secure site (it's signed by my own certificate authority so you'll get a warning if you visit that page; if you don't want to get the warning and you trust me enough, you can install my certificate authority certificate and check the fingerprints).
Once that was done, I went further and protected a directory using signed certificates for client authentication (and you'll get a very cryptic error when you visit that link without installing the proper certificate). TinyCA makes the process painless to play around with this stuff (and for the curious, the configuration file).
Now, the recent mess with logging in via ssh got me thinking. It would be nice if we (as in, The Company) could use secure certificates to log in via ssh. Sure, we can generate key files to have password-less logins, but we have a few customers that also need ssh access, and having a secure certificate would be nice. Not only could we set the expiration date, but we could also revoke the certificate should it be become necessary (a compromised account, non-payment of bills or an employee (heaven forbid) being let go).
Now, given that TinyCA is a basic frontend to OpenSSL, and that OpenSSH uses OpenSSL, I expected OpenSSH to have support for signed certificates.
Apparently not, but there is a patch for it. This is something I need to look into.
Update on Thursday, May 18th, 2023
https://secure.conman.org/ is no longer as all my sites are
now secure.
