4 ms·
I had to think of exactly this post as well and I started to wonder, whether Caddy-SSH couldn't even handle this using Caddy's built-in ACME support?
by eliaspro 5y ago
I had to think of exactly this post as well and I started to wonder, whether Caddy-SSH couldn't even handle this using Caddy's built-in ACME support?
- mholt 5y agoIt could, if there was an ACME server doling out SSH certificates. And Caddy can get certificates via more than just ACME, it's completely extensible, so it will work with... anything I guess.
- tialaramex 5y agoAlthough the word "Certificate" is in the name of this feature and the expansion of ACME, they don't really have much in common. ACME is similar to, and different from the Internet's other certificate protocols, both in ways that are not helpful for a SSH server. Firstly ACME is similar in that it's about X.509 certificates roughly PKIX flavoured, whereas certificates in SSH don't use X.509 and thus don't use PKIX Then it's different in that ACME solves the proof-of-control problem for the Web PKI, it was actually built in parallel with what became the "10 Blessed Methods" for the Web PKI (but today there are not ten of them). But almost nobody wants public SSH servers for random people from the Internet to access, so the Web PKI is largely irrelevant to certificates for SSH servers. [ The Web PKI is the name for the PKI that makes your web browser work, unlike SSH you actually do use web browsers to connect to random public stuff - lots of other things rely on the Web PKI, not just the Web but there are good reasons it is called the Web PKI anyway ]