Sign an SSH host certificate.

POST

/v1/projects/{projectId}/ssh-ca/sign-host

Code sample: Shell / cURL

curl --request POST \
  --url https://stratum.example.com/v1/projects/example/ssh-ca/sign-host \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... root@host", "instanceId": "i-A8c2D4e6F", "principals": [ "i-A8c2D4e6F.compute.internal", "i-A8c2D4e6F" ], "validForSeconds": 7776000 }'

• A Stratum cluster endpoint.

Signs an instance’s SSH host public key into a host certificate so connecting clients stop seeing the TOFU “unknown host key” prompt. The cert’s principals are the instance’s hostnames/FQDNs; it carries no source-address pin. Default validity is 90 days (clamped to the per-project host ceiling,); hosts re-sign before expiry. Signing happens inside OpenBao — the CA key never leaves it. Gates on the compute:SignSSHHostCert Cedar action on the target instance (granted to the instance-agent service account in the first-boot flow).

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

Request Body^required

Media typeapplication/json

body for POST /v1/projects/{projectId}/ssh-ca/sign-host.

object

publicKey

required

The instance’s SSH host public key in OpenSSH authorized-key form (e.g. the contents of /etc/ssh/ssh_host_ed25519_key.pub).

string

Example

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... root@host

instanceId

required

The instance the host certificate is for. Used as the cert KeyId and to scope the Cedar compute:SignSSHHostCert check.

string

Example

i-A8c2D4e6F

principals

required

The hostnames / FQDNs the certificate certifies. sshd matches the connect-time hostname against these.

Array<string>

>= 1 items

Example

[
  "i-A8c2D4e6F.compute.internal",
  "i-A8c2D4e6F"
]

validForSeconds

Requested validity in seconds. Defaults to 90 days (7776000). Clamped to the per-project host ceiling; when clamped the response carries an X-Stratum-Warning header.

integer

Example

7776000

Responses

200

The signed host certificate.

Media typeapplication/json

A signed SSH user certificate.

object

cert

required

The signed certificate in OpenSSH authorized-key form.

string

serial

required

The certificate serial (hex).

string

validFrom

string format: date-time

validUntil

required

string format: date-time

principals

required

Array<string>

Example

{
  "cert": "ssh-ed25519-cert-v01@openssh.com AAAA...",
  "serial": "e00021a9c16e9fbc"
}

400

Bad request.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}