I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH.
I am trying to conceive how our security team will manage this on the CA side. One thing I would like to be able to do is, after signing a key, I would like to "query" that key to get information about it. In particular, for a given key, I'd like to know:
- With what CA was it signed (i.e. can I extract some information about the certificate used to sign this key)?
- What identity has been assigned to this key (
-I
flag to ssh-keygen) - What principal(s) are allowed by this key (
-n
ssh-keygen flag) - What is the validity time for the signature (
-V
) - What is the serial number of this signature (
-z
) - What options have been assigned to this signed key (
-O
)
Clearly, sshd necessarily needs to decode all those attributes when the key is presented. Is there a programmatic way to extract that info? I am thinking in terms of sanity checks, auditing and reporting on the security team management side.
Edit: I realized I was using incorrect terminology in this post. From the ssh-keygen manpage (emphasis mine):
ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options...
As Abraham mentioned below, keys are indeed just keys. Once a key has been signed by a CA, it is no longer just a key, but a certificate.
Lastly, in a stunning display of RTFM Fail, ssh-keygen -L -f certificate
does exactly what I need.