3 ms·

I love Digital Ocean, but they do the same thing with their API. I wrote to them about it years ago, even talked to some developers there, and the general expla

I love Digital Ocean, but they do the same thing with their API. I wrote to them about it years ago, even talked to some developers there, and the general explanation is the same: Screw around with cloud-init to get the public key. If you use the DO API to provision servers my feature request is here: https://digitalocean.uservoice.com/forums/136585-digitalocean/suggestions/9307569-return-the-droplet-s-ssh-public-key-as-part-of-api https://digitalocean.uservoice.com/forums/136585-digitalocea... Please upvote it or at the very least copy the cloud-init script to help provision your servers.

problems 10y ago
For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own. The signed cert can be validated fully by clients. Or go with a convergence style system and probe it from multiple locations. Or just give up and go with TOFU - if you never get an error even on different connections, you probably haven't been mitm'd.
- DorothySim 10y ago
  > For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own. Or just embed the signed host certificate in cloud-init.