import { SSHKeyGeneratorService } from './ssh-key-generator.service';
import { CAManagerService } from './ca-manager.service';
/**
 * Internal interface for ephemeral certificates
 * Not exposed via REST API
 * @internal
 */
export interface EphemeralCertificate {
    certificate: string;
    privateKey: string;
    publicKey: string;
    fingerprint: string;
    expiresAt: Date;
    tenantId?: string;
}
/**
 * Internal service for generating ephemeral SSH certificates
 * Used only by the terminal service for WebSocket SSH connections
 * @internal
 */
export declare class CertificateSignerService {
    private readonly keyGenerator;
    private readonly caManager;
    private readonly logger;
    constructor(keyGenerator: SSHKeyGeneratorService, caManager: CAManagerService);
    /**
     * Generate ephemeral certificate for internal SSH connections
     * This is ONLY called internally by the terminal service
     * Never expose this via REST API as it returns private keys
     */
    generateEphemeralCertificate(tenantId?: string, ttlSeconds?: number): Promise<EphemeralCertificate>;
    /**
     * Sign public key with CA (internal helper)
     */
    private signPublicKeyWithCA;
}
