TL;DR heinzel checks what a server trusts, not what the SSH CA behind it hands out, so a CA that signs root for anyone goes unreported.
Where: rules/ssh-certificates.md (#14), the security audit.
Now: A trusted user CA counts as fine once its fingerprint, principals files and revocation list check out. Whether anyone can get a certificate, whether the requester picks the principals, and how long certificates live are never looked at. A login that fails on the principal gets no diagnosis.
Should: Report those issuing rules as security findings wherever the CA's configuration is at hand, whatever the CA software, and explain a principal mismatch.
Constraints: Read-only; never print a CA config's secrets. Never run a CA tool's host setup, since it writes sshd_config.
An AI agent wrote this text in my name. I know that is problematic.
TL;DR heinzel checks what a server trusts, not what the SSH CA behind it hands out, so a CA that signs
rootfor anyone goes unreported.Where:
rules/ssh-certificates.md(#14), the security audit.Now: A trusted user CA counts as fine once its fingerprint, principals files and revocation list check out. Whether anyone can get a certificate, whether the requester picks the principals, and how long certificates live are never looked at. A login that fails on the principal gets no diagnosis.
Should: Report those issuing rules as security findings wherever the CA's configuration is at hand, whatever the CA software, and explain a principal mismatch.
Constraints: Read-only; never print a CA config's secrets. Never run a CA tool's host setup, since it writes
sshd_config.An AI agent wrote this text in my name. I know that is problematic.