53 lines
1.3 KiB
Go
53 lines
1.3 KiB
Go
package ssh
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"git.unkin.net/unkin/certmanager/internal/vault"
|
|
)
|
|
|
|
// SignedCertResponse is the JSON-serialisable output returned to callers.
|
|
type SignedCertResponse struct {
|
|
SignedKey string `json:"signed_key"`
|
|
}
|
|
|
|
type signRequest struct {
|
|
CertType string `json:"cert_type"`
|
|
PublicKey string `json:"public_key"`
|
|
ValidPrincipals string `json:"valid_principals"`
|
|
TTL string `json:"ttl"`
|
|
}
|
|
|
|
type signResponse struct {
|
|
Data struct {
|
|
SignedKey string `json:"signed_key"`
|
|
} `json:"data"`
|
|
}
|
|
|
|
// SignHostCert signs an SSH host public key via the Vault SSH secrets engine.
|
|
func SignHostCert(client *vault.Client, mountPoint, roleName, publicKey string, principals []string, ttl string) (*SignedCertResponse, error) {
|
|
if ttl == "" {
|
|
ttl = "87600h"
|
|
}
|
|
|
|
req := signRequest{
|
|
CertType: "host",
|
|
PublicKey: publicKey,
|
|
ValidPrincipals: strings.Join(principals, ","),
|
|
TTL: ttl,
|
|
}
|
|
|
|
var resp signResponse
|
|
path := fmt.Sprintf("%s/sign/%s", mountPoint, roleName)
|
|
if err := client.Post(path, req, &resp); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if resp.Data.SignedKey == "" {
|
|
return nil, fmt.Errorf("vault returned empty signed_key")
|
|
}
|
|
|
|
return &SignedCertResponse{SignedKey: resp.Data.SignedKey}, nil
|
|
}
|