Skip to content

Latest commit

 

History

History
37 lines (24 loc) · 1.05 KB

generating-the-key-revocation-list-krl.md

File metadata and controls

37 lines (24 loc) · 1.05 KB

Generating the Key Revocation List (KRL)

The KRL is a compact binary format which allows revoking SSH signed certificates.

  1. Create an empty revoking list:
❯ touch /etc/ssh/revoked_keys
  1. Update /etc/ssh/sshd_config to include the new Key Revocation List:
❯ RevokedKeys /etc/ssh/revoked_keys
  1. When necessary, revoke the first signed certificate:
❯ ssh-keygen -k -f revoked_keys -s sshuser.root.ca.pub foo-cert.pub
  1. When necessary, append more revoked certificates (using -u):
❯ ssh-keygen -k -f revoked_keys -s sshuser.root.ca.pub -u bar-cert.pub
  1. Confirm that revocation worked:
❯ ssh-keygen -Qf revoked_keys foo-cert.pub
  1. Distribute the updated revoked_keys to every host (/etc/ssh/revoked_keys) using rsync, scp or other orchestration utility.

NOTE: ssh-keygen should not require the signed public certificate to revoke it. Instead, using just the serial number should work. However, this is currently not working on OpenSSH 7.2p2 (Ubuntu).