Package: ca-client
# SSH CA ClientClient for interacting with [SSH CA Server](https://github.com/commercehub-oss/ssh-ca-server).## Installation instructions1. Install ca-client```pip install ca-client```## Client Usageca-client is used to interact with the [SSH CA server]((https://github.com/commercehub-oss/ssh-ca-server)).  The client uses HTTP auth to verify identity and provides facilities for listing roles, signing public keys and getting CA certificates.After completing a signing request ca-client will load the signed certificate and private key into memory with ssh-agent.  ssh-agent will sling certs at a remote host until a successful challenge response occurs granting access to the remote host.  By default sshd will reject the client after 5 failed attempts.  ca-client will not load a certificate with ssh-agent if it will exceed 5 active certificates.  The private key and signed certificate must be loaded with ssh-agent and both count towards the limit of 5.Certificates loaded with ssh-agent do not persist a reboot.  Following a reboot you can reload using ssh-add or initiate a new signing request with ca-client.The first time ca-client is executed you must provide the FQDN of the CA server and the default certificate authority to use when issueing a signing request.```$ ca-clientFailed to load configuration from /Users/username/.ca-client/config.jsonEnter FQDN of CA Server: ca-server.mydomain.comEnter name of default CA: nonproductionLoading configuration from /Users/username/.ca-client/config.json```Client configuration example:```$ cat ~/.ca-client/config.json{"DEFAULT_CA": "nonproduction","BASE_URL": "https://ca-server.mydomain.com"}```ca-client command line usage:```usage: ca-client [-h] [-s CA | -r | -c | -k CA]Tool to sign your public SSH keyoptional arguments:-h, --help           show this help message and exit-s CA, --sign CA     certificate signing request-u USER, --user USER  optional username for signing request-r, --list-roles     list my authorized roles-c, --list-cas       list available CAs-k CA, --get-key CA  list public key for CA```List your authorized roles:```$ ca-client -rRole:                ssh-admin-groupDescription:         Super Admin RoleAllowed Principals:  adminAllowed CAs:         production,nonproduction```List available certificate authorities:```$ ca-client -cCA name:         nonproductionMax duration:    30dCA name:         productionMax duration:    24h```Initiate signing request for the nonproduction certificate authority:```$ ca-client -s nonproductionPlease enter password for username:/Users/username/.ssh/nonproduction_rsa-cert.pub updatedIdentity added: /Users/username/.ssh/nonproduction_rsa (/Users/username/.ssh/nonproduction_rsa)Certificate added: /Users/username/.ssh/nonproduction_rsa-cert.pub (username)Identity loaded for current session but ssh-agent will not persist identities on rebootIf using bash you can add the following command to your .bash_profilessh-add /Users/username/.ssh/nonproduction_rsa```The ca-client will create a unique keypair for each of the requested certificate authorities within the users .ssh folder.Example users .ssh folder after requesting certs from production and nonproduction certificate authority.```$ ls ~/.sshnonproduction_rsa          nonproduction_rsa-cert.pub nonproduction_rsa.pubproduction_rsa             production_rsa-cert.pub    production_rsa.pub```The below examples shows the result of a successfully signed SSH certificate:```$ ssh-keygen -L -f ~/.ssh/nonproduction_rsa-cert.pub~/.ssh/nonproduction_rsa-cert.pub:Type: ssh-rsa-cert-v01@openssh.com user certificatePublic key: RSA-CERT 3c:3d:47:...Signing CA: RSA 2b:2a:23:...Key ID: "username"Serial: 12515602213705584981Valid: from 2017-02-06T17:03:00 to 2017-03-08T17:04:44Principals:usernameadminCritical Options: (none)Extensions:permit-X11-forwardingpermit-agent-forwardingpermit-port-forwardingpermit-ptypermit-user-rc```