search

glassechidna / lastkeypair

A serverless SSH certificate authority to control access to machines using IAM and Lambda
Apache License 2.0
49 stars 5 forks source link

Support key rotation #32

Open aidansteele opened 6 years ago

aidansteele commented 6 years ago

When instances do an lkp host setup, it could install both the "active" CA pubkey and an "inactive" one (or more) ready for rotation when the time comes.

aidansteele commented 6 years ago

Question: Should the lkp host command assume that the instance's keypair is the CA pubkey, or should it only use the pubkey returned by the Lambda?

rupertbg commented 6 years ago

If it uses the one of the Lambda then that would make rotations easier as you could ... potentially.. schedule the host signing periodically?

aidansteele commented 6 years ago

I like your thinking