I’m trying to use cryptography to generate a SSH authorized key that is use when the SSH server is set up with TrustedUserCAKeys.
On the Linux command line, the keys are setup as follows
$ ssh-keygen -t rsa -b 2048 -f test
$ ssh-keygen -s /path/to/trusted_user_ca_pk -I test -V +52w test.pub
That will create a test-cert.pub
$ cat test-cert.pub
ssh-rsa-cert-v01(a)openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNz... K8v+ESbFDSmb+Z9YIE7owjQ2m92s= test(a)test.local <mailto:xxx@xxxx.local>
$ ssh-keygen -L -f test-cert.pub
test-cert.pub:
Type: ssh-rsa-cert-v01(a)openssh.com user certificate
Public key: RSA-CERT SHA256:pXIIcD3P9mD7BLzYYKlx70kNE4y4pkEuJmFsRuUrpFc
Signing CA: RSA SHA256:a16H80IMdKLq9WZfaMqAEB9kYx7zFzmbwQP3cOeELPI (using rsa-sha2-512)
Key ID: "test"
Serial: 0
Valid: from 2023-09-19T23:08:00 to 2024-09-17T23:09:25
Principals: (none)
Critical Options: (none)
Extensions:
permit-X11-forwarding
permit-agent-forwarding
permit-port-forwarding
permit-pty
permit-user-rc
Since this appears to be a certificate, I was trying to use x509 to generate the certificate.
subject = Name([
x509.NameAttribute(NameOID.COMMON_NAME, oid),
])
csr = x509.CertificateSigningRequestBuilder().subject_name(
subject
).sign(private_key, hashes.SHA256(), default_backend())
# Sign the CSR with the CA private key. The ( ) allows
user_certificate = (
x509.CertificateBuilder()
.subject_name(csr.subject)
.issuer_name(subject)
.public_key(csr.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(datetime.datetime.utcnow())
.not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=days))
.sign(ca_private_key, hashes.SHA256(), default_backend())
)
authorized_key = user_certificate.public_bytes(
encoding=serialization.Encoding.PEM,
)
The only encoding that is allowed is PEM, and no formatting is allowed.
I’ve tried getting the public_key() from user_certificate, and formatting it with public_bytes(), but that just gave me a ssh-rsa algorithm key (no cert).
If this is the correct path to get what I want, how do I get this into an encoding/format for OpenSSH?
Thanks,
John
