https://github.com/menci/ssh-certdeploy
Deploy certificate to servers with SSH.
https://github.com/menci/ssh-certdeploy
Last synced: 5 months ago
JSON representation
Deploy certificate to servers with SSH.
- Host: GitHub
- URL: https://github.com/menci/ssh-certdeploy
- Owner: Menci
- License: mit
- Created: 2023-02-18T17:26:11.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2025-02-12T14:06:26.000Z (over 1 year ago)
- Last Synced: 2026-01-14T00:39:53.775Z (6 months ago)
- Language: Shell
- Size: 3.91 KB
- Stars: 3
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# SSH CertDeploy
Deploy certificate to servers with SSH.
* Restrict SSH key's usage to cert deploy
* Verify host key
## Usage
Clone this repo to somewhere (e.g. `/opt/ssh-certdeploy`). Generate an SSH key for deploying. Add the public key to the server's `/root/.ssh/authorized_keys`:
```
command="/opt/ssh-certdeploy/receive-cert.sh example",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-ed25519
```
The example stands for the `config.example.sh` configuration file. It's an example that print the deployed certificate and key file to stdout. Create a new configuration file and change the command above.
```bash
CERT_FILE="/etc/nginx/ssl/ssl.crt"
KEY_FILE="/etc/nginx/ssl/ssl.key"
RELOAD_CMD="systemctl reload nginx"
```
To deploy the certificate in your automated workflow, run `send-cert.sh`:
```bash
# Get host key of the server
grep your-host.domain.tld ~/.ssh/known_hosts > known_hosts_for_server
# Put file content of `known_hosts_for_server` to your workflow's environment
# Also put your SSH key's private key file on it
./send-cert.sh \
root@your-host.domain.tld 22 \
"$KNOWN_HOSTS_FOR_SERVER" \
deploy-key/id_ed25519_certdeploy \
ssl.crt ssl.key
```