SSH CA Server is a centralized certificate authority for managing SSH access across multiple servers. Instead of distributing public keys manually to each server, you can issue short-lived SSH certificates that are automatically trusted by all configured servers.
Run this command on any SSH server to configure it to trust certificates from this CA:
curl -fsSL https://ca.smartcubes.uk/v1/bootstrap/server.sh | sudo bashThis will:
Run this command on your client machine to obtain an SSH certificate:
curl -fsSL https://ca.smartcubes.uk/v1/bootstrap/client.sh | bashYou will be prompted for:
After successful authentication, you'll receive:
Once configured, simply SSH to any server that trusts this CA:
Your SSH client will automatically use the CA certificate for authentication.
Download the CA public key
Get server bootstrap script
Get client bootstrap script
Issue new certificate (requires username + password + TOTP)
Renew existing certificate (requires renewal token)
Register a server (called automatically by bootstrap script)
If you prefer to use the API directly:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_ca -C "user@client"curl -X POST https://ca.smartcubes.uk/v1/certs/issue \
-H "Content-Type: application/json" \
-d '{
"username": "your-username",
"password": "your-password",
"totp": "123456",
"public_key": "ssh-ed25519 AAAA...",
"client_hostname": "laptop",
"requested_principals": ["your-username"],
"requested_validity": "24h"
}' | jq -r '.certificate' > ~/.ssh/id_ed25519_ca-cert.pubNew users must be created by administrators using one of the following methods:
Use the built-in command-line tool:
./bin/admin -c config.yaml user create \
--username "john" \
--password "SecurePass123" \
--generate-totp \
--max-certs-per-day 50The CLI will output the TOTP secret and QR code URL for the user to set up their authenticator app.
Create users programmatically via the admin API:
curl -X POST https://ca.smartcubes.uk/v1/admin/users \
-H "Content-Type: application/json" \
-H "X-Admin-Token: YOUR_ADMIN_TOKEN" \
-d '{
"username": "john",
"password": "SecurePass123",
"totp_secret": "BASE32_ENCODED_SECRET",
"enabled": true,
"max_certs_per_day": 50
}'./bin/admin -c config.yaml user listFor administrators and developers:
SSH CA Server 是一个集中式的SSH证书颁发机构，用于管理多台服务器的SSH访问。无需在每台服务器上手动分发公钥，您可以签发短期有效的SSH证书，这些证书会被所有已配置的服务器自动信任。
在任何SSH服务器上运行以下命令，配置其信任此CA签发的证书：
curl -fsSL https://ca.smartcubes.uk/v1/bootstrap/server.sh | sudo bash此脚本将：
在您的客户端机器上运行以下命令获取SSH证书：
curl -fsSL https://ca.smartcubes.uk/v1/bootstrap/client.sh | bash您需要输入：
认证成功后，您将获得：
配置完成后，直接SSH到任何信任此CA的服务器：
您的SSH客户端将自动使用CA证书进行身份验证。
下载CA公钥
获取服务器引导脚本
获取客户端引导脚本
签发新证书（需要用户名 + 密码 + TOTP）
续签现有证书（需要续签令牌）
注册服务器（由引导脚本自动调用）
如果您希望直接使用API：
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_ca -C "user@client"curl -X POST https://ca.smartcubes.uk/v1/certs/issue \
-H "Content-Type: application/json" \
-d '{
"username": "your-username",
"password": "your-password",
"totp": "123456",
"public_key": "ssh-ed25519 AAAA...",
"client_hostname": "laptop",
"requested_principals": ["your-username"],
"requested_validity": "24h"
}' | jq -r '.certificate' > ~/.ssh/id_ed25519_ca-cert.pub新用户必须由管理员使用以下方法之一创建：
使用内置的命令行工具：
./bin/admin -c config.yaml user create \
--username "john" \
--password "SecurePass123" \
--generate-totp \
--max-certs-per-day 50CLI工具会输出TOTP密钥和二维码URL，供用户设置身份验证器应用。
通过管理员API编程方式创建用户：
curl -X POST https://ca.smartcubes.uk/v1/admin/users \
-H "Content-Type: application/json" \
-H "X-Admin-Token: YOUR_ADMIN_TOKEN" \
-d '{
"username": "john",
"password": "SecurePass123",
"totp_secret": "BASE32_ENCODED_SECRET",
"enabled": true,
"max_certs_per_day": 50
}'./bin/admin -c config.yaml user list面向管理员和开发者：