stratumctl ssh-ca

Sign SSH user certificates + describe the project SSH CA

stratumctl ssh-ca [flags]

Aliases: sshca

Subcommands

• stratumctl ssh-ca describe: Describe the project’s SSH CA (public keys + validity ceilings)
• stratumctl ssh-ca rotate-key: Rotate the project’s SSH CA signing key
• stratumctl ssh-ca sign: Sign a short-lived SSH user certificate
• stratumctl ssh-ca trust-bundle: Emit an @cert-authority line so your SSH client trusts the project’s host certs

stratumctl ssh-ca describe

Describe the project’s SSH CA (public keys + validity ceilings)

stratumctl ssh-ca describe [flags]

Examples

stratumctl ssh-ca describe
stratumctl ssh-ca describe --project p-team-a --output json

Flags

Flag	Type	Default	Description
--project	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl ssh-ca rotate-key

Rotate the project’s SSH CA signing key

stratumctl ssh-ca rotate-key [flags]

Rotate the project’s SSH CA signing key inside OpenBao.

The previous generation is marked deprecated and stays trusted during the rotation grace window (default 24h) before it is purged; the next signature uses the new generation. Distribution of the new public key to already- running instances is handled separately.

Use –immediate for the key-compromise path: the grace window is zero and the previous generation is purged inline (no longer trusted).

Example:

stratumctl ssh-ca rotate-key --project p-team-a
stratumctl ssh-ca rotate-key --project p-team-a --immediate

Flags

Flag	Type	Default	Description
--immediate	bool	false	Compromise path: zero grace window, purge the old generation inline
--project	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl ssh-ca sign

Sign a short-lived SSH user certificate

stratumctl ssh-ca sign [flags]

Sign the supplied SSH public key into a short-lived user certificate.

The certificate’s KeyId is your IAM ARN, its principal defaults to your IAM username, and it carries a source-address critical option pinned to your source IP. Validity is clamped to the project ceiling (default 15m, max 1h).

Example:

stratumctl ssh-ca sign --project p-team-a \
  --public-key-file ~/.ssh/id_ed25519.pub --instance i-A8c2D4e6F \
  --valid-for 15m --out ~/.ssh/id_ed25519-cert.pub
ssh -i ~/.ssh/id_ed25519 <you>@<instance>

Flags

Flag	Type	Default	Description
--instance	string		Target instance ID (scopes the authz check to that instance)
--out	string		Write the signed certificate to this file instead of stdout
--principal	stringSlice		Override the certificate principals (default: your IAM username)
--project	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)
--public-key	string		OpenSSH-format public key (literal)
--public-key-file	string		Path to a file containing the OpenSSH-format public key
--valid-for	duration	0s	Requested validity (e.g. 15m, 1h); clamped to the project ceiling

stratumctl ssh-ca trust-bundle

Emit an @cert-authority line so your SSH client trusts the project’s host certs

stratumctl ssh-ca trust-bundle [flags]

Emit an OpenSSH @cert-authority line for the project’s host CA.

Adding it to your known_hosts tells ssh to trust any host presenting a certificate signed by the project’s SSH host CA, so connecting to the project’s instances no longer prompts to verify an unknown host key.

By default the line is printed to stdout. Use –known-hosts to append it to ~/.ssh/known_hosts, or –out to write it to a specific file; both manage an idempotent block delimited by “# BEGIN/END stratum ssh-ca trust-bundle” markers, so re-running refreshes the line in place (e.g. after a CA rotation) rather than appending duplicates.

Examples:

stratumctl ssh-ca trust-bundle --project p-team-a
stratumctl ssh-ca trust-bundle --project p-team-a --known-hosts
stratumctl ssh-ca trust-bundle --project p-team-a --host-pattern '*.team-a.cloud' --out./ssh_known_hosts

Flags

Flag	Type	Default	Description
--host-pattern	string	*	known_hosts host pattern the trust line applies to
--known-hosts	bool	false	Append the trust block to ~/.ssh/known_hosts (managed block, idempotent)
--out	string		Write the trust block to this file (managed block, idempotent)
--project	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)