honey ssh-ca enroll-code

Mint a one-time SSH enrollment code a user redeems for a short-lived cert

Synopsis

Calls the running honey server's admin API to mint a single-use SSH enrollment code. Hand the code to a user; they generate an SSH keypair and redeem the code for a signed certificate over the SSH enroll endpoint — no honey session token required on their side (the one-time code is the credential).

Examples: honey ssh-ca enroll-code --principal alice --ttl 1h --token "$HONEY_WEB_TOKEN" honey ssh-ca enroll-code --admin-url https://honey.example --principal alice --principal ops

honey ssh-ca enroll-code [flags]

Options

      --admin-url string        Base URL of the running honey server (to mint the code) (default "http://localhost:8765")
  -h, --help                    help for enroll-code
      --key-id string           Certificate key ID (default: first principal)
      --principal stringArray   Principal the certificate is valid for (repeatable; at least one required)
      --token string            Admin auth token (default $HONEY_WEB_TOKEN)
      --ttl duration            Certificate validity duration requested for the cert (default 1h0m0s)

Options inherited from parent commands

      --cache-dir string     Override cache directory (default: XDG_CACHE_HOME/honey)
      --cache-ttl duration   Cache time-to-live (host discovery) (default 10m0s)
      --config string        Path to honey YAML (optional; also HONEY_CONFIG or default paths)
      --debug-log string     Path to write debug logs (disables debug logging if empty)
      --dir string           Directory holding the SSH CA key (default: state dir)
      --no-cache             Bypass read/write cache (host discovery)
      --record-dir string    Session recording directory for search (TUI), web, and cue-exec; overrides defaults.record_dir; default &lt;directory of config.yaml&gt;/records
      --refresh              Ignore cached entries and refresh (host discovery)