Create SSH Certificate

[CoderMcDaniel]

I am using the 0.26.2 step-ca container. I have initialized the CA with the following: step ca init --ssh --root /home/step/certs/root_ca.crt --key /home/step/secrets/root_ca_key

I am then trying to create a user SSH certificate with the following: step ssh certificate <user> id_ecdsa. When I run this command, I select the SSHPOP provisioner created at initialization. This runs and gives me the following message: "SSHPOP requires the '--sshpop-cert' flag".

I cannot figure out how to implement that flag. Any ideas?

Thanks!

[tashian]

Hi!

The SSHPOP provisioner is only for renewals of SSH host certificates.
It enables renewal automation on SSH hosts.
You should be able to get a certificate using the JWK provisioner that was created with your CA.
But, you'll probably want to reserve that provisioner for admin purposes and create other provisioners for getting SSH user and host certificates. For example, the OpenID Connect provisioner is popular for user certificates because it enables SSO for SSH.

Hope this helps—

[CoderMcDaniel]

This helps. Appreciate it. The step ssh documentation here is a little confusing. It states to create the key pair and certificate use the step ssh certificate command. But perhaps it's correct and I should be using a different provisioner than the SSHPOP as you stated. Will report back after I give it a try.

Thanks again!

[CoderMcDaniel]

@tashian When I select the JWK provisioner, running the step ssh certificate command, I get "The requested method is not implemented by the certificate authority." When I deployed the container to run step-ca, I utilized the DOCKER_STEPCA_INIT_SSH=1 environment variable. Is there anything else required to setup the SSH keys and certificate creation?

Thanks!