Skip to content

add source addresses and extension only for user cert #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
binarycodes merged 1 commit into from
Oct 11, 2025
Merged

add source addresses and extension only for user cert #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ssh-key-signer-server-docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ jobs:
uses: docker/build-push-action@v6
with:
context: ${{ env.PROJECT_DIR }}/${{ env.PROJECT }}
push: true
push: ${{ startsWith(github.ref, 'refs/tags/v') }}
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
Expand Down
6 changes: 3 additions & 3 deletions ...er-server/src/main/java/io/binarycodes/homelab/sshkeysigner/keymanagement/KeyService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,17 +154,17 @@ public Optional<SignedPublicKeyDownload> signHostKey(final String filename, fina
return signKey(SshCertificateType.HOST, filename, bytes, keyId, principals, applicationProperties.caHostValidity());
}

private Optional<SignedPublicKeyDownload> signKey(final SshCertificateType signType, final String filename, final byte[] bytes, final String keyId, final List<String> principals, final Duration validitySeconds) {
private Optional<SignedPublicKeyDownload> signKey(final SshCertificateType certType, final String filename, final byte[] bytes, final String keyId, final List<String> principals, final Duration validitySeconds) {
try {
final var publicKeyFileToSign = SshPublicKeyFileFactory.parse(bytes);
final var keyPairToSign = SshKeyPair.getKeyPair(null, publicKeyFileToSign.toPublicKey());

final var signedBy = switch (signType) {
final var signedBy = switch (certType) {
case HOST -> readHostCAKeys();
case USER -> readUserCAKeys();
};

final var signed = SshCertManager.generateCertificate(signType, keyPairToSign, keyId, principals, validitySeconds, applicationProperties.sourceAddresses(), applicationProperties.knownExtensions(), signedBy);
final var signed = SshCertManager.generateCertificate(certType, keyPairToSign, keyId, principals, validitySeconds, applicationProperties.sourceAddresses(), applicationProperties.knownExtensions(), signedBy);

final var signedKey = SshPublicKeyFileFactory.create(signed.getCertificate(), publicKeyFileToSign.getComment(), SshPublicKeyFileFactory.OPENSSH_FORMAT);
final var signedKeyString = new String(signedKey.getFormattedKey(), StandardCharsets.UTF_8);
Expand Down
38 changes: 28 additions & 10 deletions ...erver/src/main/java/io/binarycodes/homelab/sshkeysigner/keymanagement/SshCertManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,18 @@
import com.sshtools.common.ssh.components.jce.OpenSshEd25519Certificate;
import com.sshtools.common.ssh.components.jce.OpenSshRsaCertificate;
import com.sshtools.common.util.UnsignedInteger64;
import org.apache.commons.lang3.ObjectUtils;

import java.io.IOException;
import java.time.Duration;
import java.time.Instant;
import java.time.ZoneOffset;
import java.util.Collections;
import java.util.List;

public class SshCertManager {

public static SshCertificate generateCertificate(final SshCertificateType signType,
public static SshCertificate generateCertificate(final SshCertificateType certType,
final SshKeyPair key,
final String keyId,
final List<String> validPrincipals,
Expand All @@ -32,19 +34,13 @@ public static SshCertificate generateCertificate(final SshCertificateType signTy
final List<String> knownExtensions,
final SshKeyPair signedBy) throws SshException, IOException, InvalidPassphraseException {

final var type = switch (signType) {
final var type = switch (certType) {
case HOST -> SshCertificate.SSH_CERT_TYPE_HOST;
case USER -> SshCertificate.SSH_CERT_TYPE_USER;
};

final var criticalOptions = new CriticalOption.Builder()
.sourceAddress(sourceAddresses.toArray(String[]::new))
.build();

final var extensionsBuilder = new CertificateExtension.Builder();
knownExtensions.forEach(extension -> extensionsBuilder.knownExtension(new NamedCertificateExtension(extension, true)));

final var extensions = extensionsBuilder.build();
final var criticalOptions = buildCriticalOptions(certType, sourceAddresses);
final var extensions = buildCertificateExtensions(certType, knownExtensions);

final var now = Instant.now().atZone(ZoneOffset.UTC);
final UnsignedInteger64 validAfter = new UnsignedInteger64(now.toEpochSecond());
Expand All @@ -53,6 +49,28 @@ public static SshCertificate generateCertificate(final SshCertificateType signTy
return generateCertificate(key, 0L, type, keyId, validPrincipals, validAfter, validBefore, criticalOptions, extensions, signedBy);
}


private static List<CriticalOption> buildCriticalOptions(SshCertificateType certType, List<String> sourceAddresses) {
if (certType == SshCertificateType.HOST || ObjectUtils.isEmpty(sourceAddresses)) {
return Collections.emptyList();
}

return new CriticalOption.Builder()
.sourceAddress(sourceAddresses.toArray(String[]::new))
.build();
}

private static List<CertificateExtension> buildCertificateExtensions(SshCertificateType certType, List<String> knownExtensions) {
if (certType == SshCertificateType.HOST || ObjectUtils.isEmpty(knownExtensions)) {
return Collections.emptyList();
}

final var extensionsBuilder = new CertificateExtension.Builder();
knownExtensions.forEach(extension -> extensionsBuilder.knownExtension(new NamedCertificateExtension(extension, true)));
return extensionsBuilder.build();
}


public static SshCertificate generateCertificate(final SshKeyPair key,
final long serial,
final int type,
Expand Down