SSH signer support for PuTTy format
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
Feature request
The [vault ssh signer](https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates) currently outputs SSH certificates in OpenSSH format. On Windows, it would be convenient for it to be able to also provide the PuTTy SSH certificate format (which is the PuTTy Pubkey format aka RFC4716).
Something like:
```powershell
vault write -field=signed_key_rfc4716 ssh-client-signer/sign/default public_key="$pubkey"
```
...to produce:
```
---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAABIwAAAIEA1on8gxCGJJWSRT4uOrR13mUaUk0hRf4RzxSZ1zRb
YYFw8pfGesIFoEuVth4HKyF8k1y4mRUnYHP1XNMNMJl1JcEArC2asV8sHf6zSPVffozZ
5TT4SfsUu/iKy9lUcCfXzwre4WWZSXXcPff+EHtWshahu3WzBdnGxm5Xoi89zcE=
---- END SSH2 PUBLIC KEY ----
```
It is possible to convert this currently using a small powershell script, but this requires the user to keep the script on hand.
Contributor guide
Research direction
Start with the vault ssh signer endpoint and the existing OpenSSH certificate output described in the issue. Use the example vault write command and RFC4716 sample as the behavior to compare against. Done means the signer can return a PuTTY/RFC4716-formatted certificate through the requested field without requiring a separate PowerShell conversion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100