certificates/kms/sshagentkms/testdata/cert.key at 4ad82a2f769c96a55b8dc1cbf886dbb0142e4803 - mbiryukova/certificates - TrueCloudLab

mbiryukova/certificates

forked from TrueCloudLab/certificates

Anton Lundin 3e6137110b Add support for using ssh-agent as a KMS

This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.

This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.

That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.

This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.

Signed-off-by: Anton Lundin <glance@acc.umu.se>

2020-11-04 09:06:23 +01:00

5 lines

227 B

Text

Raw Blame History

 -----BEGIN EC PRIVATE KEY-----
 MHcCAQEEICB6lIrMa9fVQJtdAYS4qmdYQ1BHJsEQDx8zxL38gA8toAoGCCqGSM49
 AwEHoUQDQgAE5VPD/W5RXn0lrs2MdoNteTSZ+sh1veT13hakPZF9YzaNVZgujqK3
 d1nt+4jPECU+ED/WQ1GgFZiVGUo3flvB/w==
 -----END EC PRIVATE KEY-----