Renew identity certificate in /ssh/rekey and /ssh/renew

api/sshRekey.go

@@ -31,6 +31,7 @@ func (s *SSHRekeyRequest) Validate() error {
 // SSHRekeyResponse is the response object that returns the SSH certificate.
 type SSHRekeyResponse struct {
 	Certificate         SSHCertificate `json:"crt"`
+	IdentityCertificate []Certificate  `json:"identityCrt,omitempty"`
 }
 
 // SSHRekey is an HTTP handler that reads an RekeySSHRequest with a one-time-token
@@ -72,7 +73,14 @@ func (h *caHandler) SSHRekey(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	JSONStatus(w, &SSHSignResponse{
+	identity, err := h.renewIdentityCertificate(r)
+	if err != nil {
+		WriteError(w, errs.Forbidden(err))
+		return
+	}
+
+	JSONStatus(w, &SSHRekeyResponse{
 		Certificate:         SSHCertificate{newCert},
+		IdentityCertificate: identity,
 	}, http.StatusCreated)
 }

api/sshRenew.go

@@ -27,6 +27,7 @@ func (s *SSHRenewRequest) Validate() error {
 // SSHRenewResponse is the response object that returns the SSH certificate.
 type SSHRenewResponse struct {
 	Certificate         SSHCertificate `json:"crt"`
+	IdentityCertificate []Certificate  `json:"identityCrt,omitempty"`
 }
 
 // SSHRenew is an HTTP handler that reads an RenewSSHRequest with a one-time-token
@@ -62,7 +63,28 @@ func (h *caHandler) SSHRenew(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	identity, err := h.renewIdentityCertificate(r)
+	if err != nil {
+		WriteError(w, errs.Forbidden(err))
+		return
+	}
+
 	JSONStatus(w, &SSHSignResponse{
 		Certificate:         SSHCertificate{newCert},
+		IdentityCertificate: identity,
 	}, http.StatusCreated)
 }
+
+// renewIdentityCertificate request the client TLS certificate if present.
+func (h *caHandler) renewIdentityCertificate(r *http.Request) ([]Certificate, error) {
+	if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
+		return nil, nil
+	}
+
+	certChain, err := h.Authority.Renew(r.TLS.PeerCertificates[0])
+	if err != nil {
+		return nil, err
+	}
+
+	return certChainToPEM(certChain), nil
+}