Private CA for SSH certificates - #21

Open

Harshit-RV wants to merge 149 commits into

fundwave:mainfrom

Harshit-RV:update/privateCA

Commits on Jun 22, 2023

Add files for private CA
sudo-rgorai
committed
798e263

Commits on Jun 23, 2023

Take AWS region as input
sudo-rgorai
committed
84a9e1d

Commits on Jun 24, 2023

Remove action for generating root X.509 certificate
sudo-rgorai
committed
1e8aa25
Use current timestamp for auth header
sudo-rgorai
committed
123b832
Accept lambda event as params
sudo-rgorai
committed
ce72f23

Commits on Jun 26, 2023

Use region for all aws services
sudo-rgorai
committed
571e245
Use exact pattern matching for deleting temporary files
sudo-rgorai
committed
abcbce9
Fix filenames in deploy-resources.sh
sudo-rgorai
committed
af7756d
Change CA action from get to generate
sudo-rgorai
committed
2e1b9b7
Delete secret.json after use
sudo-rgorai
committed
8039e58
Delete package-lock.json
sudo-rgorai
authored
ba4deb7
Fix ssh client cert validity
sudo-rgorai
committed
e27dff0
Use pubkey file instead of string for generating certificate
sudo-rgorai
committed
c30758f
Do not use response.json
sudo-rgorai
committed
99afb54

Commits on Jul 4, 2023

Base64 encode response certificate
sudo-rgorai
committed
eb67f93
Invoke function using lambda URL instead of AWS CLI
sudo-rgorai
committed
99a8b9b

Commits on Jul 6, 2023

Add -h help tag and handle invalid action
sudo-rgorai
committed
b9c2c48
Certificate validity should be decided by CA not by the subject
sudo-rgorai
committed
d38a12c
Check for existing certificates and their expiration
sudo-rgorai
committed
1b7802e

Commits on Jul 7, 2023

Add certificate expiration buffer of 5 minutes
sudo-rgorai
committed
4c70c44

Commits on Jul 11, 2023

Use awscurl instead of curl to generate certs
sudo-rgorai
committed
6efcdb3
Do not use awscurl
sudo-rgorai
committed
ff72a42
reorganize directories
Mohit Garg
committed
c854587
add awsprofile, let server decide it's own secret region
Mohit Garg
committed
d67a780

Commits on Jul 12, 2023

Add audience header
sudo-rgorai
committed
e073fbc
Use docker container
sudo-rgorai
committed
b4f21c5

Commits on Jul 13, 2023

Fix server deployment issues
sudo-rgorai
committed
b078b61

Commits on Jul 14, 2023

Add instruction for AWS secrets region environment variable
sudo-rgorai
committed
6424640
Specify certificate type
sudo-rgorai
committed
a128e39

Commits on Aug 4, 2023

private-ca: use variables for validity, cert details
Mohit Garg
committed
d4fdede
merge main
Mohit Garg
committed
28b4de3

Commits on Sep 25, 2023

Added cron job to Docker Container to regenerate certs everyday
Srinivasan T M
committed
2720292
added override default cert location for curl
Srinivasan T M
committed
23f4391

Commits on Oct 6, 2023

workflow to push private ca container to docker hub
Srinivasan T M
committed
312cda7

Commits on Oct 13, 2023

updated push path for privateCA workflow
Srinivasan T M
committed
9df7571

Commits on Oct 26, 2023

fix: set curl cert bundle path
Srinivasan T M
committed
dfa428c
fix: changed cd path [skip ci]
Srinivasan T M
committed
315bc95

Commits on May 21, 2025

fix: filter out comment lines from ssh-keyscan output in verify-fingerprint.sh
Harshit-RV
committed
b62be6a

Commits on May 30, 2025

Improve AWS metadata handling, SSH cert principals, and Docker Alpine version
Harshit-RV
committed
b5c0707
Update Docker README
Harshit-RV
committed
de78c36
fix: remove X.509 certificate generation from client and update README
Harshit-RV
committed
ec42fb1
Merge branch 'main' into update/privateCA
Harshit-RV
committed
266f584
CI: bumps ssm-env-util to 1.0.1-update/privateCA.0
fundabot
committed
c8aa3a1
Merge branch 'main' into update/privateCA
Harshit-RV
authored
0dbe931

Commits on Jun 2, 2025

fix: parameter index in generate-certificate scripts
Harshit-RV
committed
d47032f
fix: generate certificate using AWS CLI script
Harshit-RV
committed
96c2037

Commits on Jun 4, 2025

Commits on Jun 5, 2025

update README, Dockerfile, change parameter index
Harshit-RV
committed
712af90
update README.md
Harshit-RV
committed
4f8df0b

Commits on Jun 6, 2025

Commits on Jun 20, 2025

Commits on Jun 23, 2025

Commits on Jun 24, 2025

Commits on Jun 25, 2025

Commits on Jun 30, 2025

fix: changed AWS_PROFILE_ARG logic from credentials/config check to environment check
Harshit-RV
committed
79b469b

Commits on Jul 2, 2025

Commits on Jul 7, 2025

feat: add getHostCAPublicKey action in private-ca lambda
Harshit-RV
committed
684dcdb

Commits on Jul 8, 2025

Commits on Jul 9, 2025

Commits on Jul 10, 2025

Commits on Jul 17, 2025

Commits on Jul 18, 2025

feat (generate-certificate-curl.sh): check for known_hosts entry alongside cert validity and regenerate cert if not found
Harshit-RV
committed
35808c6

Commits on Jul 22, 2025

Commits on Jul 23, 2025

Commits on Jul 24, 2025

Commits on Jul 25, 2025

refactor: add cert validity param and update half-life calculation
Harshit-RV
committed
a46ae71
Update private-ca/server/src/get-public-ip-address.ts

giriparus
and
Copilot
authored
418bbbd
Update private-ca/server/src/secret-manager-utils.ts

giriparus
and
Copilot
authored
ff0d72b
Update private-ca/server/src/index_lambda.ts

giriparus
and
Copilot
authored
b2cb20f
refactor: add cert half-life param with default value as 3 days, remove cert validity in days param
Harshit-RV
committed
faaffea
fix: update script name in Dockerfile
Harshit-RV
committed
566f230
update README
Harshit-RV
committed
08e9d2e
refactor: reorder EC2-region param
Harshit-RV
committed
1fb84fd
refactor: simplify cert half life calculation
Harshit-RV
committed
b0cb5c4
fix: do not delete cert and user_ca files if cert is invalid, only clean sshd_config
Harshit-RV
committed
a9472fd
update instructions in invoke-private-ca scripts to include new parameters
Harshit-RV
committed
750be83
fix: read AWS_REGION from vars instead of secrets in update-private-ca-lambda workflow
Harshit-RV
committed
f4c4d0c
chore: add environment specification for update-private-ca-lambda workflow
Harshit-RV
committed
2fe5da1