SSH, keys & certificates

chmod 700 ~/.ssh ~/.ssh/sockets
chmod 600 ~/.ssh/config ~/.ssh/authorized_keys ~/.ssh/id_*
chmod 644 ~/.ssh/*.pub ~/.ssh/known_hosts
chmod go-w ~  # sshd rejects group-writable homes

ssh-ed25519 AAAAC3Nz... zach@laptop
from="10.0.0.0/8",restrict ssh-ed25519 AAAAC3Nz... ci@runner
command="/usr/local/bin/backup-recv",restrict ssh-ed25519 AAAAC3Nz... backup
restrict,port-forwarding,permitopen="localhost:5432" ssh-ed25519 AAAAC3Nz... db-tunnel

Include config.d/*
 
Host bastion
  HostName bastion.example.com
  User zach
 
Host app-1 app-2
  HostName %h.internal.example.com
  User deploy
  ProxyJump bastion
 
Host github-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_work
 
Host *
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes
  AddKeysToAgent yes
  IgnoreUnknown UseKeychain
  UseKeychain yes
  ServerAliveInterval 60
  ControlMaster auto
  ControlPath ~/.ssh/sockets/%C
  ControlPersist 10m

ssh -L 5433:db.internal:5432 bastion
 
 laptop                      bastion                 db.internal
 psql → 127.0.0.1:5433 ══ssh══► sshd ───tcp───► :5432

ssh -R 8080:localhost:3000 vps
 
 internet → vps:8080 ══ssh══► laptop → localhost:3000
 (vps listens on 127.0.0.1 only unless sshd has GatewayPorts yes)

ssh -D 1080 vps
 
 browser (SOCKS5 127.0.0.1:1080) ══ssh══► vps ───► any host:port

sudo sshd -t                        # syntax check
sudo sshd -T | grep -Ei 'passw|root|kbd'   # effective values
sudo systemctl reload ssh   # Fedora/RHEL: sshd

# one-time: CA keys (keep offline or in a secrets manager)
ssh-keygen -t ed25519 -f user_ca -C user_ca
ssh-keygen -t ed25519 -f host_ca -C host_ca
 
# user cert: valid 8h for logins as alice or deploy
ssh-keygen -s user_ca -I alice@laptop -n alice,deploy \
  -V +8h ~/.ssh/id_ed25519.pub   # → id_ed25519-cert.pub
ssh-keygen -Lf ~/.ssh/id_ed25519-cert.pub   # inspect
 
# host cert: run with the host's public key
ssh-keygen -s host_ca -I web1 -h \
  -n web1.example.com,10.0.0.5 -V +52w \
  /etc/ssh/ssh_host_ed25519_key.pub

Root CA          self-signed; ships in the OS / browser trust store
  │ signs
Intermediate CA  sent by the server
  │ signs
Leaf cert        SAN: example.com, www.example.com; sent by the server
 
The server sends leaf + intermediates ("fullchain"), never the root.
The client builds a path to a root it already trusts.

# Debian/Ubuntu; on Fedora/RHEL: dnf install (EPEL on RHEL)
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot certonly --webroot -w /var/www/html \
  -d example.com                  # any server, no edits
sudo certbot certonly --standalone -d example.com
sudo certbot certificates         # what's installed
sudo certbot renew --dry-run      # test renewal
systemctl list-timers | grep certbot

example.com, www.example.com {
    reverse_proxy localhost:3000
}

brew install mkcert nss     # nss: Firefox trust store
mkcert -install             # create and trust a local CA
mkcert localhost 127.0.0.1 ::1 app.test
# → localhost+3.pem, localhost+3-key.pem
export NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem"

Bun.serve({
  port: 3443,
  tls: {
    cert: Bun.file("localhost+3.pem"),
    key: Bun.file("localhost+3-key.pem"),
  },
  fetch: () => new Response("https on localhost"),
});

openssl req -x509 -newkey ec \
  -pkeyopt ec_paramgen_curve:P-256 -noenc -days 3650 \
  -keyout ca.key -out ca.crt -subj "/CN=Internal mTLS CA"
openssl req -new -newkey ec \
  -pkeyopt ec_paramgen_curve:P-256 -noenc \
  -keyout client.key -out client.csr -subj "/CN=svc-a"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -days 90 -out client.crt \
  -extfile <(printf "extendedKeyUsage=clientAuth")
curl --cert client.crt --key client.key \
  --cacert ca.crt https://api.internal/

Bun.serve({
  port: 8443,
  tls: {
    cert: Bun.file("server.crt"),
    key: Bun.file("server.key"),
    ca: Bun.file("ca.crt"), // CA that signs client certs
    requestCert: true,
    rejectUnauthorized: true,
  },
  fetch: () => new Response("hello, trusted client"),
});

ssh-keygen -t ed25519 -a 100 -C "zach@$(hostname -s)"
mkdir -p ~/.ssh/sockets && chmod 700 ~/.ssh ~/.ssh/sockets
# macOS: keep the passphrase in Keychain
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
# Linux: ssh-add ~/.ssh/id_ed25519
gh ssh-key add ~/.ssh/id_ed25519.pub \
  --type authentication --title "$(hostname -s)"
gh ssh-key add ~/.ssh/id_ed25519.pub \
  --type signing --title "$(hostname -s) signing"
ssh -T git@github.com
ssh-copy-id -i ~/.ssh/id_ed25519.pub zach@server

Host bastion
  HostName bastion.example.com
  User zach
  IdentityFile ~/.ssh/id_ed25519
 
Host 10.0.* *.internal
  User deploy
  ProxyJump bastion
  IdentityFile ~/.ssh/id_ed25519
 
# one-off without config:
#   ssh -J zach@bastion.example.com deploy@10.0.1.12
# scp and rsync hop the same way:
#   rsync -avz dist/ 10.0.1.12:/srv/app/

# local 5433 → db.internal:5432, via the bastion
ssh -fN -o ExitOnForwardFailure=yes \
  -L 127.0.0.1:5433:db.internal:5432 bastion
psql "postgres://app@127.0.0.1:5433/app"
DATABASE_URL=postgres://app:pw@127.0.0.1:5433/app \
  bun run migrate
# DB on the SSH host itself
ssh -N -L 5433:localhost:5432 db-host
# close the backgrounded tunnel
pkill -f 'L 127.0.0.1:5433'

H=example.com
# every cert the server sends: s = subject, i = issuer
openssl s_client -connect "$H:443" -servername "$H" \
  -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ +i:'
# leaf details
openssl s_client -connect "$H:443" -servername "$H" \
  </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates \
    -ext subjectAltName
# protocol, cipher, key exchange, verification result
openssl s_client -connect "$H:443" -servername "$H" \
  -brief </dev/null

SAN="DNS:dev.local,DNS:localhost,IP:127.0.0.1"
openssl req -x509 -newkey ec \
  -pkeyopt ec_paramgen_curve:P-256 -noenc -days 365 \
  -keyout dev.key -out dev.crt -subj "/CN=dev.local" \
  -addext "subjectAltName=$SAN"
openssl x509 -in dev.crt -noout -ext subjectAltName
# clients must trust dev.crt explicitly:
curl --cacert dev.crt https://dev.local:8443/

import { connect } from "node:tls";
 
const WARN = Number(process.env.WARN_DAYS ?? 21);
 
const days = (host: string) =>
  new Promise<number>((resolve, reject) => {
    const s = connect({ host, port: 443, servername: host });
    s.once("secureConnect", () => {
      const { valid_to } = s.getPeerCertificate();
      const ms = Date.parse(valid_to) - Date.now();
      resolve(Math.floor(ms / 86_400_000));
      s.end();
    });
    s.setTimeout(1e4, () => s.destroy(Error("timeout")));
    s.once("error", reject); // also fires on invalid chains
  });
 
let failed = false;
for (const host of process.argv.slice(2)) {
  const d = await days(host).catch((e: Error) => e.message);
  const ok = typeof d === "number" && d >= WARN;
  failed ||= !ok;
  console.log(`${ok ? "ok  " : "WARN"} ${host}: ${d}`);
}
process.exit(failed ? 1 : 0);

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true
# let git verify your own (and teammates') signatures
printf '%s %s\n' "$(git config user.email)" \
  "$(cat ~/.ssh/id_ed25519.pub)" >> ~/.ssh/allowed_signers
git config --global gpg.ssh.allowedSignersFile \
  ~/.ssh/allowed_signers
git commit --allow-empty -m "test: signed commit"
git log --show-signature -1
# GitHub: gh ssh-key add ~/.ssh/id_ed25519.pub --type signing