One Certificate Authority Instead Of authorized_keys
sshd can trust a CA and accept any certificate it signed, so access is granted by signing rather than by editing authorized_keys everywhere. The live test proves it four ways over a real connection: the matching certificate gets in, one for another principal does not, one that expired does not, and a key the CA never signed does not. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-27 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-ssh-ca?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [One Certificate Authority Instead Of authorized_keys](https://www.iac-bazaar.com/catalog/ansible-ssh-ca?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# One Certificate Authority Instead Of authorized_keys: https://www.iac-bazaar.com/catalog/ansible-ssh-ca (download from your IaC Bazaar account)
```Preview:
Documentation
ssh-ca
One certificate authority instead of a public key on every host. sshd can
trust a CA and accept any certificate it signed, with a principal list, a validity
window and a revocation list - so access is granted by signing and withdrawn by
expiry rather than by editing authorized_keys everywhere. This role configures
that trust and proves it four ways: the matching certificate gets in, one for
another principal does not, an expired one does not, and a key the CA never signed
does not.
No download, and no version to pin. openssh-server is EL 10. What the role owns is one sshd drop-in and the mode of the CA public key it points at - and what it will not do is create a certificate authority, because the private half belongs somewhere this host cannot reach.
One certificate does not open every account. AuthorizedPrincipalsFile
defaults to none, and sshd then requires the account being logged into to appear
in the certificate's principal list - measured, a certificate naming one account
was refused by another. That is the check doing the work by default, and it is why
the stricter per-account file is off.
AuthorizedPrincipalsFile fails CLOSED, so it is off by default. With it
set, an account whose principals file is EMPTY is refused, and an account with no
principals file at all is refused too. Both measured. It is the stricter shape and
worth having, but turning it on without a file for every account that has to keep
working takes the host away.
The role refuses to run without the CA public key, on purpose.
TrustedUserCAKeys pointing at a file that is not there leaves sshd trusting
nothing and every certificate refused - which looks exactly like a broken CA
rather than a missing file. So the role checks first and stops with a message that
says where to put the key, and it never generates one: a role that created a
certificate authority on every managed host would be handing out signing
authority.
Revocation is the other half of a CA, and it works. ssh-keygen -k -f makes
an empty KRL, -k -u -f adds a certificate to it, and with RevokedKeys in the
drop-in that certificate is refused while another one from the same CA still gets
in. It is off by default because RevokedKeys naming a file that is not there is
another way to lose every login.
sshd says which rule refused, and the test reads it. Three of the four cases are refusals, and only the journal distinguishes them: "error: Certificate invalid: expired" for the expired one, and an accepted login records the certificate type, its ID, its serial and the CA's fingerprint. The live test asserts the expiry message rather than treating three identical refusals as three different proofs.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-aide
AIDE from AppStream on EL 10: a watched tree, a baseline database built once, and the oneshot unit and timer the package does not ship. The live test passes on an unchanged host, FAILS when a file appears inside a watched path and names it, ignores one inside an excluded path, and passes again once the change is gone. Original role, live-tested on Rocky Linux 10.
ansible-authelia
Authelia from the upstream release (sha256-verified) as a hardened system service on loopback with file users and sqlite; its secrets are generated once on the host and reach the service as AUTHELIA_*_FILE variables. The live test hashes a password with Authelia's hasher, logs in, sees a wrong password refused and an anonymous visitor sent to the portal. Original role, live-tested on Rocky 10.
ansible-bandit
bandit on EL 10 from PyPI into a venv of its own with a link in the PATH; the live test runs pip check, then scans a module that passes a string to subprocess.call with shell=True (B602, High, exit 1) and a clean module (exit 0). Pinned. Original role, live-tested on Rocky Linux 10.
ansible-boundary
boundary on EL 10 from releases.hashicorp.com; SHA256SUMS is signature-checked against HashiCorp's key before get_url trusts it, the live test re-checks both, then runs authenticate against a dead address ('connection refused') and database init with a throwaway config (parsed, root key loaded, then the database refused). Pinned. Original role, live-tested on Rocky Linux 10.
ansible-dockle
dockle on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then scans a one-layer image whose config names no user, expecting CIS-DI-0001 in the output, exit code 1 with --exit-level warn, and the warning counted in the JSON form. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-gitleaks
gitleaks on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the project's checksums file, and re-checked with sha256sum -c by the live test, which then plants a file holding an AWS access key that is not one and runs gitleaks detect over it, expecting 'leaks found: 1'. Original role, live-tested on Rocky Linux 10.