3 ms·
Rookie mistake: SSH has no CRL, it has an KRL. And its actually a separate thing since it operates largely independently from the CA. I have one in place. Use
by blueflow 5y ago
Rookie mistake: SSH has no CRL, it has an KRL.
And its actually a separate thing since it operates largely independently from the CA.
I have one in place. Used it once to terminate access for someone.
- OrvalWintermute 5y agoIt sounds like you could be making the rookie mistake instead by not reading what he/she actually wrote. > Yeah the lack of mentioning a CRL at all really stood out when reading this. I actually didn't know about SSH certificates until I saw this article (I always assumed that SSH did not support this), but do run my own CA and authentication for internal web services, EAP-TLS, and VPN. The CRL is your first line of defense in the sense that it blocks the use of that credential instantly when it is revoked. This sounds like he/she is running an x509 CA. He/she is generating certs for various use-cases. It is possible to use x509 certs with SSH of course, and so he/she could leverage his/her pre-existing CA for that function. Given above context CRL is completely accurate. And, KRL is not.
- egberts1 5y agoNo, SSL CA certificate are in no way like OpenSSL CA issued ones. The format of the certificate have diverged between two ecospheres about a decade ago.
- pritambaral 5y agoRookie mistake: SSH's KRL is also a CRL. See KEY REVOCATION LISTS in ssh-keygen(1). You can revoke plain keys with it, but also revoke certs (both by serial number and identity) with it. The infrastructure I built for access control using SSH certs used it. I know it works because I tested for it specifically.