ca

package

v1.1.0 Latest Latest Go to latest Published: Sep 5, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Details

Package ca owns postern's SSH certificate authority: the CA key's lifecycle and (from S2.2 on) certificate signing.

This section is empty.

This section is empty.

This section is empty.

type CA struct {
	// contains filtered or unexported fields
}

CA holds the signing key. Bir postern kurulumunda tek bir CA vardır.

func Init(path string) (*CA, error)

Init generates a new CA key at path and returns the ready CA.

func Load(path string) (*CA, error)

Load reads an existing CA key from path.

func (c *CA) AuthorizedKey() string

AuthorizedKey returns the public key as a single authorized-keys line, ready to be pasted into /etc/ssh/postern_ca.pub.

func (c *CA) PublicKey() ssh.PublicKey

PublicKey returns the CA's public half — the content targets put in TrustedUserCAKeys.

func (c *CA) Sign(req CertRequest) (*ssh.Certificate, error)

type CertRequest struct {
	PublicKey ssh.PublicKey

	KeyID string

	Principals []string

	ValidFor time.Duration

	Extensions map[string]string
}