I'm setting up an SSH key signing server, using Neflix BLESS as the base github(dot)com/Netflix/bless.
There is a critical option for source-address to ensure that the certificate can only be used from a list of specific IP addresses, but I cannot find an option for a destination-address to restrict access to a single server.
We are not using a bastion host and want to ensure that the signed key that is returned, isn't simply used against another server that recognizes the CA, but to which the user isn't authorized.
I've checked https://www.freebsd.org/cgi/man.cgi?query=ssh-keygen&sektion=1&manpath=OpenBSD and https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD and can't seem to find an option that would handle this.
The only thing that I've see that might lend some insight is
...if an implementation does not recognise a optionthen the validating party should refuse to accept the certificate.
Which makes me think that there may be some list of what some implementation supports, but I can't seem to find anything.