SSH Certication Authority Support #1929

New Issue

GiteaMirror · 2025-11-02T04:18:06-06:00

GiteaMirror commented

2025-11-02 04:18:06 -06:00

Originally created by @NicolausVanSchie on GitHub (Jun 13, 2018).

Gitea version (or commit ref): 1.4.2
Git version: 2.17.1
Operating system: Arch Linux
Database:
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes
- No
- Not relevant

Description

Openssh supports the use of normal ssh keys as a Certication Authority, outlined here: ssh-keygen(1).
This can be used as an alternative form of key management for a user if the openssh server is being used.

For openssh to treat a key as a CA, the cert-authority option has to be added to the key in the authorized_keys file (sshd(8)).
As the CA key cannot be used directly to auth with the server, an option to set the key as a CA would be required.

While testing out CA keys, I made a proof of concept patch, available here.
I used docker when testing these changes, and followed this guide to setup the keys for testing.

Originally created by @NicolausVanSchie on GitHub (Jun 13, 2018). - Gitea version (or commit ref): 1.4.2 - Git version: 2.17.1 - Operating system: Arch Linux - Database: - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes - [ ] No - [x] Not relevant ## Description Openssh supports the use of normal ssh keys as a Certication Authority, outlined here: [`ssh-keygen(1)`](https://man.openbsd.org/ssh-keygen#CERTIFICATES). This can be used as an alternative form of key management for a user if the openssh server is being used. For openssh to treat a key as a CA, the `cert-authority` option has to be added to the key in the `authorized_keys` file ([`sshd(8)`](https://man.openbsd.org/sshd#cert-authority)). As the CA key cannot be used directly to auth with the server, an option to set the key as a CA would be required. While testing out CA keys, I made a proof of concept patch, available [here](https://github.com/NicolausVanSchie/gitea/commit/4c9279b79ffe7860e7a442ce1fe19a2b7e47aaab). I used docker when testing these changes, and followed [this guide](https://github.com/cloudtools/ssh-cert-authority#using-openssh-certificates) to setup the keys for testing.

GiteaMirror added the type/feature type/proposal labels 2025-11-02 04:18:06 -06:00

GiteaMirror closed this issue

2025-11-02 04:18:06 -06:00

GiteaMirror commented

2025-11-02 04:18:06 -06:00

@techknowlogick commented on GitHub (Dec 9, 2020):

introduced in 1.13.0

@techknowlogick commented on GitHub (Dec 9, 2020): introduced in 1.13.0

GiteaMirror referenced this issue

2025-11-02 12:02:55 -06:00

[PR #1929] [MERGED] Change join chat from gitter to discord #16127

Sign in to join this conversation.