<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/gitlab/gitlab-shell.git/internal/testhelper/testdata/testroot/certs/valid/server-cert.pub, branch main</title>
<subtitle>gitlab.com: gitlab-org/gitlab-shell.git
</subtitle>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-shell.git/'/>
<entry>
<title>gitlab-sshd: Add support for configuring host certificates</title>
<updated>2022-06-26T07:11:42+00:00</updated>
<author>
<name>Stan Hu</name>
<email>stanhu@gmail.com</email>
</author>
<published>2022-06-11T21:42:25+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-shell.git/commit/?id=4919ec7a1ef3bcf7a8b2da1a5369c9135845f55e'/>
<id>4919ec7a1ef3bcf7a8b2da1a5369c9135845f55e</id>
<content type='text'>
This adds support for specifying host certificates via the
`host_cert_files` option and advertises the signed key to the
client. This acts similarly to OpenSSH's `HostCertificate` parameter:
gitlab-sshd attempts to match a host key to its certificate, and then
substitutes the matching host key with a certificate signed by a
trusted certificate authority's key.

This is the first requirement to supporting SSH certificates. This
will enable the client to trust the server if both trust a common
certificate authority. The `TrustedUserCAKeys` option will need to be
supported later for the server to trust all user keys signed by this
certificate authority.

Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/495
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This adds support for specifying host certificates via the
`host_cert_files` option and advertises the signed key to the
client. This acts similarly to OpenSSH's `HostCertificate` parameter:
gitlab-sshd attempts to match a host key to its certificate, and then
substitutes the matching host key with a certificate signed by a
trusted certificate authority's key.

This is the first requirement to supporting SSH certificates. This
will enable the client to trust the server if both trust a common
certificate authority. The `TrustedUserCAKeys` option will need to be
supported later for the server to trust all user keys signed by this
certificate authority.

Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/495
</pre>
</div>
</content>
</entry>
</feed>
