As long as it is not as easy as let’s encrypt, it won’t take off.
I quite agree: as long as it's not as easy as Let's Encrypt then it won't take off.
> Note that OpenSSH certificates are a different, and much simpler, format to the X.509 certificates used in ssl(8).
Where do you work with x.509 certificates when doing an SSH ca? I use SSH certificates productively and only ever used ssh-keygen commands.
x509 supports all of the things that ssh key file format does ... and also a lot more. ssh supports x.509 too so that makes it "easier". When you use `ssh` to connect, you'd specify -I and point to the private key and it will automatically try to find a certificate file whose name is identical to the identity file but with "-cert.pub" appended (see `man ssh_config`). There's another option to explicitly specify the key certificate file `CertificateFile` but there's no short-argument version so you have to use `-o CertificateFile [filename]` or add that to your `~/ssh/.config` file.
You'd need to use `openssl` command (or, of course, any openssl-like command line) to sign the your SSH key. And, of course, openssl doesn't understand ssh key files so you have to use `ssh-keygen` to convert the key to x509 format or else generate the key using `openssl` (but again, at least ssh understands x509 natively so the downside is having the much longer x509 text). And that's quite the arcane part: openssl cli is fucking awful. It doesn't follow normal command line conventions, doesn't have tab autocompletion, and its documentation is obscure/difficult to find, extremely terse, and difficult to even understand if you're not already explicitly familiar with exactly your inputs and outputs.
And then there's the whole process of getting your key file signed. At least that process is (in general) identical to having a web SSL key signed -- because the private key is actually identical but the only nominal difference is the format of the file that you normally think of using for it. But the workflow is different because the certificate doesn't get installed to somewhere that a webserver would want. I had ended up creating my own Certificate Authority to test with and that was yet another rabbit hole of anger management.
Thanks! That sounds quite condescending. I'd educated myself by reading about ssh keys in ssh and wondering how to use them.
Perhaps you should make your own blog post describing how to do it all using only ssh-keygen then.
The source of truth (in sync with your currently installed version) is right on your disk. Invoke `man ssh-keygen`.
Sorry for my tone. I'm pissed that, every second day, some person comes along and demonstrates to me that I'm seemingly the only person in the world who is reading the documentation on the tools we all use. Like, how do you even know what you are doing?
Indeed, using ssh-keygen for the whole process certainly seems easier.
SSH certificates themselves are similar to x.509 but a lighter version. They are supported out of the box.
Many folks are comfortable with jumping through the hoops (following instructions) WITHOUT understanding what's really happening.
Those of us who aren't comfortable with "just works" need to plow through a enormous amount of persnickety jargon and easily forgettable material to reach an understanding that gives us confidence.