I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH.
I am trying to conceive how our security team will manage this on the CA side. One thing I would like to be able to do is, after signing a key, I would like to "query" that key to get information about it. In particular, for a given key, I'd like to know:
- With what CA was it signed (i.e. can I extract some information about the certificate used to sign this key)?
- What identity has been assigned to this key (
-Iflag to ssh-keygen)
- What principal(s) are allowed by this key (
- What is the validity time for the signature (
- What is the serial number of this signature (
- What options have been assigned to this signed key (
Clearly, sshd necessarily needs to decode all those attributes when the key is presented. Is there a programmatic way to extract that info? I am thinking in terms of sanity checks, auditing and reporting on the security team management side.
Edit: I realized I was using incorrect terminology in this post. From the ssh-keygen manpage (emphasis mine):
ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options...
As Abraham mentioned below, keys are indeed just keys. Once a key has been signed by a CA, it is no longer just a key, but a certificate.
Lastly, in a stunning display of RTFM Fail,
ssh-keygen -L -f certificate does exactly what I need.