{"_id":"@andrewheberle/serverless-ssh-ca","_rev":"13-43dff896a6d2fc9b5ba5449cf411e5b2","name":"@andrewheberle/serverless-ssh-ca","dist-tags":{"latest":"0.17.18"},"versions":{"0.17.5":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.5","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.5","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"a77b1a06bb0637ca0cfcab7e67502824bd1ebda5","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.5.tgz","fileCount":81,"integrity":"sha512-m0X2o58LwuWqdSN/OWr+Za3Px7Y+hJr1BBNiwjUVol1R0Vi0zgGlqCbct4Nj9XkaUFLnZTTFExf7v66rewx8Ng==","signatures":[{"sig":"MEYCIQCbIlRn/h6KzCa2RbTRcemNsL2it1EfEaIPYNSg2mtJDwIhAK3GGKxcdSLwp9GGORgTiD9wIE6DbSS8UsGMYRVwutBz","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":218966},"main":"dist/index.js","type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"c4c72b39fb412562aeebd427c432deb32cc16b03","scripts":{"test":"vitest run","build":"tsc","release":"release-it","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"},"release-it":{"git":false,"npm":{"skipChecks":true}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git","directory":"packages/ssh-ca"},"_npmVersion":"11.12.1","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.15.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","@cloudflare/workers-types":"^4.20260528.1"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.5_1779957197384_0.08392626688681215","host":"s3://npm-registry-packages-npm-production"}},"0.17.6":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.6","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.6","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"b2172acc3a638be78e82396da70d56bbb11cf0da","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.6.tgz","fileCount":43,"integrity":"sha512-xKV4z5CTAaGIX9fc1FAuxEYdNIDUoIijYzMBZ0J/MVZFP9nouzPfnqdVzBVSo645TTpJ267kRDIJPyItxEtlSg==","signatures":[{"sig":"MEYCIQD6WPhBJcIMaDz3X96QyF+zUhHYAWmM9OHyZ/hhd5E0dgIhAJUcwHZYbtR2tiQ2y1PzolyU1JJSjqLwAwwpI/tyY8HB","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.6","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129649},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"6b1f9fcb01b097be0544f1a9f4dd2f45daaffb42","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.6_1780035003403_0.5607550707323579","host":"s3://npm-registry-packages-npm-production"}},"0.17.7":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.7","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.7","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"a83fc0ce465732a7df433670faf59e0f6d280616","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.7.tgz","fileCount":43,"integrity":"sha512-5pRBI965GGoPISHm4ckkfF1KUJMKydYhU7GMyWfQXgAfWntdWxr+TKESuoqxU+7RPtODJW+iQ0nHTczLlnFkoQ==","signatures":[{"sig":"MEUCIFwGLYVF2laPfhQCRwEaU89e6/0J9rbxAIae5dFt8fCgAiEAhtjJywQTk6fwGPezV4Z/krJGJygpCaTDFfp7Px6L5nY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.7","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129679},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"d4cd134c084d91b7625b898536e66c9fe4df8de3","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.7_1780035852435_0.13340231966183147","host":"s3://npm-registry-packages-npm-production"}},"0.17.8":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.8","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.8","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"c0848b03f5b1581137909555032e11a96640678d","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.8.tgz","fileCount":43,"integrity":"sha512-O1IaqqR/hFPMnaZ7X6eL1iQ9yaPMi9fr92c8dUC5uN3vOCpyowWkAp49Ru1441GTKIiZTHSalVryll+vEmse8Q==","signatures":[{"sig":"MEYCIQDxAuDApAHjZbX0qNQfGHHtr/bUmn8jRIXztkduNW8w3QIhAO8G3er+lL8vqS8Nyvw/D9C0ac3N1dMKjXmPT1oLq0qh","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.8","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129679},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"dc15dfe85db1629db5040ac837d8a1a44fdac7a2","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.8_1780036383743_0.8905868627909455","host":"s3://npm-registry-packages-npm-production"}},"0.17.9":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.9","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.9","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"a5bbb5061629e7cc8aeee9e733926c60acd77fc3","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.9.tgz","fileCount":43,"integrity":"sha512-WYKnE/e8+kPA8JjYWaPcOQ4B9MGsDRvaM6VD5dl6DLxUg4ZcrOtFDT5ZPMjusmHoaocFAGKeHCCDxx1csljHmw==","signatures":[{"sig":"MEYCIQD8s+RNtSIaRXcQMWb3ikCG1FEnqn3BAiV4f/UWM1Tm/wIhAO8ZsqXxHkKkZDQs4nXYkcU5qhUkAeQ+r/h5HzN6Tjn4","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.9","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129679},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"f14b4678a82083dd3c4ffaa51edc99a68ac9e863","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.9_1780036496489_0.16037203282118773","host":"s3://npm-registry-packages-npm-production"}},"0.17.10":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.10","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.10","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"a30bf858c3b334e9f5420fa5d8468bba999d3a2d","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.10.tgz","fileCount":43,"integrity":"sha512-8BksN3hxapngB9VEm8hPJzXmYDDwpe+JpMuMIqnWQ1FII4fhuU9WQDRRzRL+CY058XDzpx8rMtVpKVGMKl5aKQ==","signatures":[{"sig":"MEUCICyZn4q1DDsdDFjm+fEoBGOxNP1h1+cLirbGrdeLqCrnAiEA6KYmSj70LlrdbTe229+dpmAR8+A3kLpoB+3vTc+F0Hg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.10","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129680},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"475ada06c239a625405abc7a84d2e6b8d83f7cd5","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.10_1780037352935_0.23939662122496275","host":"s3://npm-registry-packages-npm-production"}},"0.17.11":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.11","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.11","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"ee7c06cfd8e122508e772e0328d95d94f2fbc0d0","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.11.tgz","fileCount":43,"integrity":"sha512-FRzVrhxLcEr2FiNEkUlmwUcs4jLOcmqPRe9oSKrxEblKAhJjjFRqQ32xGCqIHV9jnSoMBuUNzwwkh2lTDvB/kg==","signatures":[{"sig":"MEUCIEgUq817pSGRnm4XLmV0/d1gziKRbfgm7PiFyaMJH6gOAiEAhVKaUGbd8+mfDoFUpE0XXqk7hokLANFLEVPsiLV+XhU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.11","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129680},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"cbecddc7dccfc4b77cfe0da9c87cf8c99af986fc","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.11_1780037570083_0.6140812932398563","host":"s3://npm-registry-packages-npm-production"}},"0.17.12":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.12","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.12","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"1e10bc3f46b9945c42dd3469167a0f920c9db4f5","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.12.tgz","fileCount":43,"integrity":"sha512-CNQZNOYODsAIZMrT5tbb1sDskIhHbw6vcrDRoCPnl0j6FoW/ssyFIgHU5kCyISk9smvP6w1yoxmurNCnbuvSiw==","signatures":[{"sig":"MEYCIQC2zgJeorrWPI8Qx7O2WC25J/p0+Y6QIamWTXywRo5WhwIhAK/SuQRbRDwuW1cxk0RU5rh4gg13vy04DaV1O5/yxTUX","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.12","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129680},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"6e825ae1cd76ea7813c6194fc2df098321a3c1e7","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.12_1780037877235_0.38667069359682715","host":"s3://npm-registry-packages-npm-production"}},"0.17.13":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.13","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.13","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"bad9277059fcf6339d86c1cb7168a5c21923de59","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.13.tgz","fileCount":43,"integrity":"sha512-wDMByR7/nsXH3ACvatQBq8v4RzQM2qKBiDHoUvnLokmSXMy40duNxQUKcmwJZO+vUDbenN1c8ABS8xc5QTaEMA==","signatures":[{"sig":"MEYCIQDYpAsdZ6iSoUe0cfMZJnxxL937iLK+TuD06HdqaABp2gIhAMVocDrl0YA25zduafD8oxrRCycNauuvF1f+5LNGB5Lj","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.13","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":129680},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"ea8ea69711324f1566fa217aaa9fc0399df0568b","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","@cloudflare/actors":"^0.0.1-beta.6","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","release-it":"^20.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","auto-changelog":"^2.5.1","@vitest/coverage-istanbul":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.13_1780038087547_0.92786514746598","host":"s3://npm-registry-packages-npm-production"}},"0.17.15":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.15","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.15","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"c03d2f6759323e89a77ce2b74abac1cbcb222da3","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.15.tgz","fileCount":112,"integrity":"sha512-pHnPffgzZjRra0d/3w8Y2Y6heYCYtSJ9IDvMT8wLLrla4g0oUeQENbV9TNHskS3q48Z227IqWUWA2Rjyyx7kJg==","signatures":[{"sig":"MEUCIACL3p+FL0jHhZm4KfeBGNxrGML0wzkWS9KEKlrAiq07AiEAyTgEKtZSZT9eRO/YZsf5Zb3lnDOfWp4cXXmmUzQN77o=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.15","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":298219},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"45e68b041e8dae5530db1c89b3500675f7265dca","scripts":{"test":"vitest run","build":"tsc","release":"release-it","coverage":"vitest run --coverage","release:ci":"release-it --ci","test:watch":"vitest","prepublishOnly":"npm run build","release:dryrun":"release-it --dry-run"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"release-it":{"git":false,"npm":{"publish":true,"skipChecks":true}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.16.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","workers-qb":"^1.14.0","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","vitest":"^4.1.7","typescript":"^6.0.0","@types/sshpk":"^1.17.4","@vitest/coverage-v8":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.15_1780323534178_0.3521875363111091","host":"s3://npm-registry-packages-npm-production"}},"0.17.16":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.16","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.16","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"1b52b6203f3b61ce395a06bd0d6ac812f185564f","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.16.tgz","fileCount":112,"integrity":"sha512-ZOtsd5a+mO3IrnSoHNaRRV/s+XDW282xmV1qHChe2FeRgVfnwlMBBn5AE6/a8HssMAEADxr3xbqtTodBoSI2hw==","signatures":[{"sig":"MEUCIQCo5Nxv+8LCuUjkml5FHRp3icV/PUeL3lBKol5H0cAMGwIgDu9KyzUst2zF1T/BR+od0hY723Vt0tdu2TxmtGm8Y/c=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.16","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":303254},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"0e297d0de554e2dcfaf42f9cad280cfb6c4d407b","scripts":{"lint":"eslint","test":"vitest run","build":"tsc","schema":"node --require tsx/cjs scripts/export-schema.cjs","release":"release-it","coverage":"vitest run --coverage","release:ci":"npm run release:patch","test:watch":"vitest","prepublishOnly":"npm run build","release:dryrun":"release-it --dry-run","release:ci:major":"release-it major --ci","release:ci:minor":"release-it minor --ci","release:ci:patch":"release-it patch --ci"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"release-it":{"git":false,"npm":{"publish":true,"skipChecks":true}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.17.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","workers-qb":"^1.14.0","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","eslint":"^10.4.1","vitest":"^4.1.7","@eslint/js":"^10.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","typescript-eslint":"^8.61.0","@vitest/coverage-v8":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.16_1782788458699_0.13205109093103617","host":"s3://npm-registry-packages-npm-production"}},"0.17.17":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.17","author":{"name":"Andrew Heberle"},"license":"Apache-2.0","_id":"@andrewheberle/serverless-ssh-ca@0.17.17","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"dist":{"shasum":"18e1395eb71013b4683c6795eb653deca18b6149","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.17.tgz","fileCount":112,"integrity":"sha512-NITpKZkOOvGv/uM0sRK2yaYu0eWWVVYpaWigjCZ9/dA7tjVPSzUDLsbnACWZ3CugzwO9nMSiD14nMtda8/Se7g==","signatures":[{"sig":"MEUCIQD0i7DLDozbCk9wEYM86nffwQ83FdsspujtajnmGdj4VAIgUPuVfBmh3mEqHSe8RmmlCUv71PzMGH6zywORCj9kfmQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.17","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":303254},"type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"5bfec5244f283a06a29648636fc5a1addd030443","scripts":{"lint":"eslint","test":"vitest run","build":"tsc","schema":"node --require tsx/cjs scripts/export-schema.cjs","release":"release-it","coverage":"vitest run --coverage","release:ci":"npm run release:patch","test:watch":"vitest","prepublishOnly":"npm run build","release:dryrun":"release-it --dry-run","release:ci:major":"release-it major --ci","release:ci:minor":"release-it minor --ci","release:ci:patch":"release-it patch --ci"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"release-it":{"git":false,"npm":{"publish":true,"skipChecks":true}},"repository":{"url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git","type":"git"},"_npmVersion":"11.13.0","description":"A serverless SSH CA built on Cloudflare Workers","directories":{},"_nodeVersion":"24.17.0","dependencies":{"zod":"^4.0.0","hono":"^4.10.6","jose":"^6.0.12","sshpk":"^1.18.0","chanfana":"^3.0.0","itty-time":"^2.0.2","workers-qb":"^1.14.0","@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.21.0","eslint":"^10.4.1","vitest":"^4.1.7","@eslint/js":"^10.0.1","typescript":"^6.0.0","@types/sshpk":"^1.17.4","typescript-eslint":"^8.61.0","@vitest/coverage-v8":"^4.1.7"},"_npmOperationalInternal":{"tmp":"tmp/serverless-ssh-ca_0.17.17_1782788852056_0.17093558747351745","host":"s3://npm-registry-packages-npm-production"}},"0.17.18":{"name":"@andrewheberle/serverless-ssh-ca","version":"0.17.18","description":"A serverless SSH CA built on Cloudflare Workers","type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"scripts":{"build":"tsc","coverage":"vitest run --coverage","lint":"eslint","prepublishOnly":"npm run build","release":"release-it","release:ci":"npm run release:patch","release:ci:major":"release-it major --ci","release:ci:minor":"release-it minor --ci","release:ci:patch":"release-it patch --ci","release:dryrun":"release-it --dry-run","schema":"node --require tsx/cjs scripts/export-schema.cjs","test":"vitest run","test:watch":"vitest"},"dependencies":{"@andrewheberle/ts-slog":"^1.3.0","@cloudflare/workers-types":"^4.20260528.1","chanfana":"^3.0.0","hono":"^4.10.6","itty-time":"^2.0.2","jose":"^6.0.12","workers-qb":"^1.14.0","sshpk":"^1.18.0","zod":"^4.0.0"},"devDependencies":{"@eslint/js":"^10.0.1","@types/sshpk":"^1.17.4","@vitest/coverage-v8":"^4.1.7","eslint":"^10.4.1","tsx":"^4.21.0","typescript":"^6.0.0","typescript-eslint":"^8.61.0","vitest":"^4.1.7"},"repository":{"type":"git","url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git"},"homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"author":{"name":"Andrew Heberle"},"license":"Apache-2.0","release-it":{"git":false,"npm":{"publish":true,"skipChecks":true}},"gitHead":"aa054f060a9176880cc651deb4ed312a3599353f","_id":"@andrewheberle/serverless-ssh-ca@0.17.18","_nodeVersion":"24.18.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-sZZQzN3stPJ/KK4+8Ln5SaN4shjQDFBhy/RrUqnTRW8ViO2Ae3A4hriz4lr//C05iAZft5qnixpOchLeQpp7LA==","shasum":"5adc28ff05f1ae5c7bb5220c780e4b16f46ec6ef","tarball":"https://registry.npmjs.org/@andrewheberle/serverless-ssh-ca/-/serverless-ssh-ca-0.17.18.tgz","fileCount":112,"unpackedSize":304115,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@andrewheberle%2fserverless-ssh-ca@0.17.18","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCYU8zwgJQFxI196FClViYQ/vokfenXg/ZYT8IdyrKHXAIgNzIRo89hD7QhPIrYYq4CNxva7/lp8uMccG8jUpV5hJs="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:6aa38a32-f212-41f6-bad6-b922d2ec0ed2"}},"directories":{},"maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/serverless-ssh-ca_0.17.18_1784090217166_0.5933636169843526"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-28T08:33:17.227Z","modified":"2026-07-15T04:36:57.587Z","0.17.5":"2026-05-28T08:33:17.559Z","0.17.6":"2026-05-29T06:10:03.544Z","0.17.7":"2026-05-29T06:24:12.574Z","0.17.8":"2026-05-29T06:33:03.893Z","0.17.9":"2026-05-29T06:34:56.611Z","0.17.10":"2026-05-29T06:49:13.073Z","0.17.11":"2026-05-29T06:52:50.230Z","0.17.12":"2026-05-29T06:57:57.375Z","0.17.13":"2026-05-29T07:01:27.749Z","0.17.15":"2026-06-01T14:18:54.324Z","0.17.16":"2026-06-30T03:00:58.868Z","0.17.17":"2026-06-30T03:07:32.198Z","0.17.18":"2026-07-15T04:36:57.301Z"},"bugs":{"url":"https://github.com/andrewheberle/serverless-ssh-ca/issues"},"author":{"name":"Andrew Heberle"},"license":"Apache-2.0","homepage":"https://github.com/andrewheberle/serverless-ssh-ca#readme","repository":{"type":"git","url":"git+https://github.com/andrewheberle/serverless-ssh-ca.git"},"description":"A serverless SSH CA built on Cloudflare Workers","maintainers":[{"name":"andrewheberle","email":"andrew.heberle@shrewhome.net"}],"readme":"## @andrewheberle/serverless-ssh-ca\n\nThis is the package that implements the SSH CA functionality which can be deployed\nto Cloudflare as a working solution using the \"Deploy to Cloudflare\" button below:\n\n[![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https%3A%2F%2Fgithub.com%2Fandrewheberle%2Fserverless-ssh-ca-template)\n\nTo use the package in your own Worker manually (assuming you have the requried\nbindings in place), the following code in `src/index.ts` (your Worker's main\nfile) will work:\n\n```ts\nimport app from \"@andrewheberle/serverless-ssh-ca\"\n\nexport default app\n```\n\nThis package **only** works with Cloudflare Workers and there are no plans to make\nthis a generic solution at this time.\n\nSee the following respositories for additional information:\n\n\n| Repostitory | Details |\n|---|---|\n| [https://github.com/andrewheberle/ssh-ca-client](https://github.com/andrewheberle/ssh-ca-client) | Contains client code for issuing user and host certificates |\n| [https://github.com/andrewheberle/serverless-ssh-ca-template](https://github.com/andrewheberle/serverless-ssh-ca-template) | Contains a template repository for deployment to Cloudflare Workers |\n\n## Architecture\n\nThe solution comprises of the CA running as a Worker, a Go based client\n(found [here](https://github.com/andrewheberle/ssh-ca-client])) and a third\nparty OIDC IdP.\n\nThe IdP may be any OIDC compatible service that returns a JWT with at least\nan `email` claim in the OIDC access token, however at this time only\nCloudflare Access has been tested.\n\n### User Certificates\n\nThe flow to obtain a User SSH certificate using the CLI version is as follows:\n\n1. The user initiates `ssh-ca-client-cli login`\n2. If required a new SSH key is generated and the a browser is opened to\n   visit `http://localhost:3000/auth/login`\n3. The client redirects the user to the configured IdP\n4. The IdP returns the user to the callback URL (default\n   `http://localhost:3000/auth/callback`)\n5. The client uses the JWT from the IdP as `Authorization: Bearer <TOKEN>`\n   in a `POST` request containing the users SSH public key to the CA's\n   `/api/v3/user/certificate` endpoint\n6. The CA verifies the incoming JWT and assuming it is valid and verified, will\n   respond with a signed certificate based on the provided public key\n7. The client saves the certificate and adds the SSH private key and\n   certificate to the local SSH Agent.\n\nThis flow is shown below once the user executes `ssh-ca-client-cli login`:\n\n```mermaid\nsequenceDiagram\n    User->>Client: GET /auth/login\n    activate Client\n    Client-->>User: Redirect to IdP\n    deactivate Client\n    activate User\n    User->>IdP: OIDC authentication flow\n    deactivate User\n    activate IdP\n    IdP-->>User: Redirect to Client\n    deactivate IdP\n    activate User\n    User->>Client: Completes OIDC redirect\n    deactivate User\n    activate Client\n    activate Client\n    Client-->>User: Auth flow completed\n    deactivate Client\n    Client->>CA: POST /api/v3/user/certificate\n    deactivate Client\n    activate CA\n    CA-->>Client: Signed certificate\n    deactivate CA\n    activate Client\n    Client->>SSH Agent: Add key and certificate to Agent\n    deactivate Client\n```\n\nIf a refresh token is available, the process looks like this when running\n`ssh-ca-client-cli login`:\n\n```mermaid\nsequenceDiagram\n    Client->>IdP: Request authentication token\n    activate IdP\n    IdP-->>Client: Token returned\n    deactivate IdP\n    activate Client\n    Client->>CA: POST /api/v3/user/certificate\n    deactivate Client\n    activate CA\n    CA-->>Client: Signed certificate\n    deactivate CA\n    activate Client\n    Client->>SSH Agent: Add key and certificate to Agent\n    deactivate Client\n```\n\nIf the process to request a new authentication token fails using the refresh\ntoken, the standard authentication process is followed which requires user\ninteraction.\n\n### Host Certificates\n\n#### Initial Request\n\nThe process to request an intitial Host certificate is similar to obtaining\na User certificate once `ssh-ca-client-cli host` is run, however instead of\nadding the obtained certificate to a SSH Agent, it is written to\n`<KEYPATH>-cert.pub` instead:\n\n```mermaid\nsequenceDiagram\n    User->>Client: GET /auth/login\n    activate Client\n    Client-->>User: Redirect to IdP\n    deactivate Client\n    activate User\n    User->>IdP: OIDC authentication flow\n    deactivate User\n    activate IdP\n    IdP-->>User: Redirect to Client\n    deactivate IdP\n    activate User\n    User->>Client: Completes OIDC redirect\n    deactivate User\n    activate Client\n    activate Client\n    Client-->>User: Auth flow completed\n    deactivate Client\n    Client->>CA: POST /api/v3/host/certificate\n    deactivate Client\n    activate CA\n    CA-->>Client: Signed certificate\n    deactivate CA\n    activate Client\n    Client->>Writes Certificate: Certificate written to disk\n    deactivate Client\n```\n\n#### Renewals\n\nRenewals are done using the existing certificate and will succeed if:\n\n1. The certificate is not expired\n2. It was issued by the CA\n3. The public key used to obtain the certificate is the same as the one\ncurrently presented\n\nThis means the OIDC authentication flow is not required in this case as shown\nbelow when `ssh-ca-client-cli host --renew` is run:\n\n```mermaid\nsequenceDiagram\n    Client->>CA: POST /api/v3/host/renew\n    activate CA\n    CA-->>Client: Signed certificate\n    deactivate CA\n    activate Client\n    Client->>Writes Certificate: Certificate written to disk\n    deactivate Client\n```\n\n## Configuration\n\n### Identity Provider\n\nThis example shows the configuration in Cloudflare Access, however other\nOIDC IdP's should be generally equivalent:\n\n![Basic OIDC Settings](docs/images/oidc-example_01.png)\n\nThe `Redirect URL` must match the configured value in the client.\n\nTransfer the IdP settings as follows:\n\n![IdP Settings](docs/images/oidc-example_02.png)\n\nThe `openid` and `email` scopes are required, with enabling of refresh tokens\n(the `offline_access` scope) being optional, but recommended.\n\n### Client\n\nPlease visit the ssh-ca-client repository for further information:\n\nhttps://github.com/andrewheberle/ssh-ca-client\n\n### SSH Endpoints\n\n#### Host Configuration\n\nFor systems to allow SSH login using certificates the following configuration\nchanges must be made:\n\n```ssh\nPubkeyAuthentication yes\nTrustedUserCAKeys /etc/ssh/ca.pub\nAuthorizedPrincipalsFile /etc/ssh/principals.d/%u\n# Uncomment the following lines to enable host certificates\n# HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub\n# HostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub\n# HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub\n```\n\nThe contents of `/etc/ssh/ca.pub` is the public key of the SSH CA, which can be\nretrieved as follows:\n\n```sh\ncurl https://ssh-ca.example.com/api/v3/ca | sudo tee /etc/ssh/ca.pub\n```\n\nThe `/etc/ssh/principals.d` directory should contain a file corresponding to\na local user that contains a list of principals that should be allowed\nlogin.\n\nUsing the principals list in `SSH_CERTIFICATE_PRINCIPALS` above, the\nfollowing file named `/etc/ssh/principals.d/admin` would allow login\nas the SSH user `admin` for the bearer of an issued (and valid) certificate:\n\n```\nssh-admin\n```\n\n#### Client Configuration\n\nIn order for a client to trust a certificate presented by a host the following\nconfiguration must be added to `/etc/ssh/ssh_known_hosts` (system wide) or\n`~/.ssh/known_hosts` (user specific):\n\n```\n@cert-authority *.example.com ecdsa-sha2-nistp256 ....\n```\n\nThe format of the above file is documented in the `ssh(1)` man page however\nthe important items of note is the `*.example.com` above tells `ssh` that the\nCA public key (ie `ecdsa-sha2-nistp256 ....`) is trusted for all hosts, that\nmatch `*.example.com`.\n\nThis will need adjusting depending on your environment along with the actual\nSSH CA public key which can be retrieved as follows:\n\n```sh\ncurl https://ssh-ca.example.com/api/v3/ca\n```\n\nOnce the above configuration is completed and host certificates are in place\nclients will not require \"trust on first use\" (TOFU) as the certificate will be\nverified as being signed by the configured SSH CA.\n","readmeFilename":"README.md"}