Skip to main content

honey ssh-ca sign

honey ssh-ca sign​

Sign a user SSH public key into a short-lived certificate

Synopsis​

Signs a user's SSH public key into a short-lived OpenSSH user certificate valid for the given principals. The user then connects with both the private key and the issued certificate:

honey ssh-ca sign --pubkey alice.pub --principal alice --ttl 1h ssh -i alice -i alice-cert.pub alice@gateway -p 12222 <resource>

honey ssh-ca sign [flags]

Options​

  -h, --help                    help for sign
      --key-id string           Certificate key ID (default: first principal)
      --out string              Output path for the certificate ('-' for stdout; default: &lt;pubkey&gt;-cert.pub)
      --principal stringArray   Principal the certificate is valid for (repeatable; at least one required)
      --pubkey string           Path to the user's SSH public key to sign (required)
      --ttl duration            Certificate validity duration (default 1h0m0s)

Options inherited from parent commands​

      --cache-dir string     Override cache directory (default: XDG_CACHE_HOME/honey)
      --cache-ttl duration   Cache time-to-live (host discovery) (default 10m0s)
      --config string        Path to honey YAML (optional; also HONEY_CONFIG or default paths)
      --debug-log string     Path to write debug logs (disables debug logging if empty)
      --dir string           Directory holding the SSH CA key (default: state dir)
      --no-cache             Bypass read/write cache (host discovery)
      --record-dir string    Session recording directory for search (TUI), web, and cue-exec; overrides defaults.record_dir; default &lt;directory of config.yaml&gt;/records
      --refresh              Ignore cached entries and refresh (host discovery)

SEE ALSO​

  • honey ssh-ca - Manage the SSH certificate authority used by the SSH gateway